diff --git a/.github/workflows/build-frontends.yml b/.github/workflows/build-frontends.yml
index 7c5f33a760..160b521d82 100644
--- a/.github/workflows/build-frontends.yml
+++ b/.github/workflows/build-frontends.yml
@@ -10,7 +10,15 @@ permissions:
   contents: read
 
 jobs:
+  # Skip push builds for branches whose open PR already builds them; see pr-build-gate.yml.
+  gate:
+    permissions:
+      pull-requests: read
+    uses: ./.github/workflows/pr-build-gate.yml
+
   build:
+    needs: gate
+    if: needs.gate.outputs.run == 'true'
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/build-ilspy.yml b/.github/workflows/build-ilspy.yml
index 02a4f96ad1..6750475abb 100644
--- a/.github/workflows/build-ilspy.yml
+++ b/.github/workflows/build-ilspy.yml
@@ -15,8 +15,16 @@ env:
   StagingDirectory: buildartifacts
 
 jobs:
+  # Skip push builds for branches whose open PR already builds them; see pr-build-gate.yml.
+  Gate:
+    permissions:
+      pull-requests: read
+    uses: ./.github/workflows/pr-build-gate.yml
+
   Build:
     name: Desktop (Windows)
+    needs: Gate
+    if: needs.Gate.outputs.run == 'true'
     permissions:
       packages: write  # for dotnet nuget push
     runs-on: windows-2025-vs2026
@@ -274,15 +282,19 @@ jobs:
         path: ICSharpCode.ILSpyCmd\bin\Release\ilspycmd*.nupkg
         if-no-files-found: error
 
-  # Linux and macOS build the desktop solution filter, run the UI and decompiler tests on
-  # their own platform, and package self-contained Release bundles. NuGet packing and all
-  # Windows-specific packaging stay in the Windows job above. The decompiler tests need the
-  # ILSpy-tests submodule (the TargetNet40 configs compile against its legacy reference
-  # assemblies even on non-Windows); configs that genuinely need Windows (legacy csc, mcs,
-  # 32-bit, roundtrip) self-exclude via Tester.SupportedOnCurrentPlatform and
-  # [Platform("Win")]. ILSpy.Tests.Windows runs only in the Windows job by design.
+  # Linux and macOS build the desktop solution filter, run the UI tests on their own
+  # platform, and package self-contained Release bundles. NuGet packing and all
+  # Windows-specific packaging stay in the Windows job above. The decompiler tests run on
+  # Linux but not macOS (already covered by Windows + Linux; they dominate the runtime of
+  # the slowest job); they need the ILSpy-tests submodule (the TargetNet40 configs compile
+  # against its legacy reference assemblies even on non-Windows); configs that genuinely
+  # need Windows (legacy csc, mcs, 32-bit, roundtrip) self-exclude via
+  # Tester.SupportedOnCurrentPlatform and [Platform("Win")]. ILSpy.Tests.Windows runs only
+  # in the Windows job by design.
 
   Desktop:
+    needs: Gate
+    if: needs.Gate.outputs.run == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -344,6 +356,7 @@ jobs:
 
     - name: Execute decompiler tests
       id: decompiler-tests
+      if: matrix.platform != 'macos'
       run: >
         dotnet test --project ICSharpCode.Decompiler.Tests/ICSharpCode.Decompiler.Tests.csproj
         --configuration Release
diff --git a/.github/workflows/pr-build-gate.yml b/.github/workflows/pr-build-gate.yml
new file mode 100644
index 0000000000..a0b436bd43
--- /dev/null
+++ b/.github/workflows/pr-build-gate.yml
@@ -0,0 +1,32 @@
+name: PR build gate
+
+on:
+  workflow_call:
+    outputs:
+      run:
+        description: Whether the push-triggered build should run
+        value: ${{ jobs.gate.outputs.run }}
+
+jobs:
+  # Skip push builds for branches whose open PR (base master/release/*) already builds
+  # them via the pull_request trigger. Pushes to master/release/* always build (they
+  # may publish packages, and no PR of theirs may suppress that).
+  gate:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      run: ${{ steps.check.outputs.run }}
+    steps:
+    - id: check
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        prs=0
+        case "$GITHUB_EVENT_NAME/$GITHUB_REF_NAME" in
+          push/master|push/release/*) ;;
+          push/*) prs=$(gh api -X GET "repos/$GITHUB_REPOSITORY/pulls" -f state=open \
+            -f head="$GITHUB_REPOSITORY_OWNER:$GITHUB_REF_NAME" \
+            --jq 'map(select(.base.ref == "master" or (.base.ref | startswith("release/")))) | length') ;;
+        esac
+        echo "run=$([ "$prs" = 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"