diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 3575dd2ffc..82f0f87d8e 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -54,17 +54,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
+        java: [ '17', '21', '25' ]
+        profile: [ '', '-Pjakartaee11' ]
+        exclude:
           - java: '17'
-            profile: ''
-          - java: '21'
-            profile: ''
-          - java: '21'
             profile: '-Pjakartaee11'
-          - java: '25'
+          # Pull requests build the oldest JDK and the newest on Jakarta EE 11; pushes build everything.
+          - java: ${{ github.event_name == 'pull_request' && '21' || 'none' }}
+          - java: ${{ github.event_name == 'pull_request' && '25' || 'none' }}
             profile: ''
-          - java: '25'
-            profile: '-Pjakartaee11'
     steps:
       - name: Checkout code
         if: needs.changes.outputs.code == 'true'
diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml
index 2dde9deb95..0dcf862610 100644
--- a/.github/workflows/owasp.yml
+++ b/.github/workflows/owasp.yml
@@ -16,7 +16,12 @@
 name: OWASP checkup
 
 on:
+  # Not a required check, so path filtering cannot leave a pull request blocked.
   pull_request:
+    paths:
+      - '**/pom.xml'
+      - 'src/etc/project-suppression.xml'
+      - '.github/workflows/owasp.yml'
   push:
     branches:
       - 'main'