diff --git a/.github/scripts/auto-tag.sh b/.github/scripts/auto-tag.sh
index f49fec0..f56a095 100644
--- a/.github/scripts/auto-tag.sh
+++ b/.github/scripts/auto-tag.sh
@@ -66,18 +66,12 @@ target_paths() {
       cat <<'EOF'
 examples/nextjs-vercel-ai-sdk-chat
 :(exclude)examples/nextjs-vercel-ai-sdk-chat/README.md
-.github/workflows/docker-publish.yml
-.github/workflows/docker-auto-tag.yml
-.github/scripts/auto-tag.sh
 EOF
       ;;
     cli)
       cat <<'EOF'
 examples/gonkagate-chat-cli
 :(exclude)examples/gonkagate-chat-cli/README.md
-.github/workflows/docker-publish.yml
-.github/workflows/docker-auto-tag.yml
-.github/scripts/auto-tag.sh
 EOF
       ;;
     *)
diff --git a/.github/workflows/docker-auto-tag.yml b/.github/workflows/docker-auto-tag.yml
index afefb29..1385413 100644
--- a/.github/workflows/docker-auto-tag.yml
+++ b/.github/workflows/docker-auto-tag.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches:
       - main
+    paths:
+      - "examples/nextjs-vercel-ai-sdk-chat/**"
+      - "examples/gonkagate-chat-cli/**"
     paths-ignore:
       - "examples/dockerhub/**"
       - "examples/nextjs-vercel-ai-sdk-chat/README.md"
diff --git a/AGENTS.md b/AGENTS.md
index cd6deb9..d32d8e5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -66,6 +66,13 @@ There is no single root build/test pipeline yet. Work from the specific example
 
 If you add a new example, document exact install/run commands in that example's `README.md`.
 
+## Docker Release Automation Guardrails
+- Auto-tag/release triggers must be scoped only to runnable example sources:
+  - `examples/nextjs-vercel-ai-sdk-chat/**`
+  - `examples/gonkagate-chat-cli/**`
+- Do not include `.github/**`, `examples/dockerhub/**`, or README-only documentation paths as release-target changes in `.github/scripts/auto-tag.sh`.
+- Before merging auto-tag logic changes, run `Docker Auto Tag` in `dry_run: true` mode to confirm no unintended tags are created.
+
 ## Coding Style & Naming Conventions
 - Use clear, minimal, copy-paste-friendly code.
 - Use normalized language folder names in `sdk/` (`csharp`, `node`, `python`, `go`, `java`, `curl`).
diff --git a/examples/dockerhub/RELEASING.md b/examples/dockerhub/RELEASING.md
index eae53ac..00ecf37 100644
--- a/examples/dockerhub/RELEASING.md
+++ b/examples/dockerhub/RELEASING.md
@@ -28,7 +28,11 @@ Create these public repositories in Docker Hub namespace `gonkagate`:
 
 Workflow: `.github/workflows/docker-auto-tag.yml`
 
-On every push to `main`, the workflow inspects changes and creates tags:
+On push to `main`, the workflow runs only when files change in:
+- `examples/nextjs-vercel-ai-sdk-chat/**`
+- `examples/gonkagate-chat-cli/**`
+
+Then it inspects changes and creates tags:
 
 - `nextjs-vX.Y.Z` for Next.js example changes
 - `cli-vX.Y.Z` for CLI example changes
@@ -39,6 +43,8 @@ Docs-only changes do not trigger auto-tag for these files:
 - `examples/gonkagate-chat-cli/README.md`
 - `examples/README.md`
 
+Automation-only changes in `.github/**` also do not trigger auto-tag anymore.
+
 Important:
 - If `TAG_PUSH_TOKEN` is set, tags are pushed with that PAT.
 - If `TAG_PUSH_TOKEN` is missing, workflow falls back to `GITHUB_TOKEN` and explicitly dispatches `.github/workflows/docker-publish.yml` for newly created tags.