diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index dbdae760c29..e8f3bae01a3 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -9,10 +9,37 @@ on:
     branches:
       - main
       - v[0-9]+-stable
+    paths:
+      - '**'
+      - '!README*'
+      - '!LICENSE*'
+      - '!LICENSES/**'
+      - '!TODO'
+      - '!docs/**'
+      - '!man/**'
+      - '!catalog/**'
+      - '!shell-completion/**'
+      - '!po/**'
+      - '!.**'
+      - '.github/**'
+
   pull_request:
     branches:
       - main
       - v[0-9]+-stable
+    paths:
+      - '**'
+      - '!README*'
+      - '!LICENSE*'
+      - '!LICENSES/**'
+      - '!TODO'
+      - '!docs/**'
+      - '!man/**'
+      - '!catalog/**'
+      - '!shell-completion/**'
+      - '!po/**'
+      - '!.**'
+      - '.github/**'
 
 permissions:
   contents: read
@@ -72,19 +99,19 @@ jobs:
         EOF
 
     - name: Build ${{ matrix.distro }}
-      run: sudo python3 -m mkosi build
+      run: sudo mkosi build
 
     - name: Show ${{ matrix.distro }} image summary
-      run: sudo python3 -m mkosi summary
+      run: sudo mkosi summary
 
     - name: Boot ${{ matrix.distro }} systemd-nspawn
-      run: sudo python3 -m mkosi boot ${{ env.KERNEL_CMDLINE }}
+      run: sudo mkosi boot ${{ env.KERNEL_CMDLINE }}
 
     - name: Check ${{ matrix.distro }} systemd-nspawn
-      run: sudo python3 -m mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
+      run: sudo mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
 
     - name: Boot ${{ matrix.distro }} QEMU
-      run: sudo timeout -k 30 10m python3 -m mkosi qemu
+      run: sudo timeout -k 30 10m mkosi qemu
 
     - name: Check ${{ matrix.distro }} QEMU
-      run: sudo python3 -m mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
+      run: sudo mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
diff --git a/mkosi.build b/mkosi.build
index 70721a88a30..5f6208dd887 100755
--- a/mkosi.build
+++ b/mkosi.build
@@ -61,7 +61,7 @@ done
 # version 5.6.0 to satisfy meson which makes bpf work on CentOS Stream 8 as well.
 if [ "$(grep '^ID=' /etc/os-release)" = "ID=\"centos\"" ] && [ "$(grep '^VERSION=' /etc/os-release)" = "VERSION=\"8\"" ]; then
         cp /usr/sbin/bpftool /usr/sbin/bpftool.real
-        cat > /usr/sbin/bpftool <<EOF
+        cat >/usr/sbin/bpftool <<EOF
 #!/bin/sh
 if [ "\$1" = --version ]; then
         echo 5.6.0
@@ -220,7 +220,7 @@ if [ -n "$IMAGE_VERSION" ] ; then
                 -e '/^IMAGE_VERSION=/!p' \
                 -e "\$aIMAGE_VERSION=$IMAGE_VERSION" <$OSRELEASEFILE >"/tmp/os-release.tmp"
 
-        cat /tmp/os-release.tmp > "$DESTDIR"/usr/lib/os-release
+        cat /tmp/os-release.tmp >"$DESTDIR"/usr/lib/os-release
         rm /tmp/os-release.tmp
 fi
 
@@ -238,7 +238,7 @@ if [ -n "$SANITIZERS" ]; then
 
         mkdir -p "$DESTDIR/etc/systemd/system.conf.d"
 
-        cat > "$DESTDIR/etc/systemd/system.conf.d/10-asan.conf" <<EOF
+        cat >"$DESTDIR/etc/systemd/system.conf.d/10-asan.conf" <<EOF
 [Manager]
 ManagerEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
                    UBSAN_OPTIONS=$UBSAN_OPTIONS\\
@@ -253,7 +253,7 @@ EOF
         # sanitizer failures appear directly on the user's console.
         mkdir -p "$DESTDIR/etc/systemd/system/systemd-journald.service.d"
 
-        cat > "$DESTDIR/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf" <<EOF
+        cat >"$DESTDIR/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf" <<EOF
 [Service]
 StandardOutput=tty
 EOF
@@ -265,7 +265,7 @@ EOF
 
         mkdir -p "$DESTDIR/etc/systemd/system/console-getty.service.d"
 
-        cat > "$DESTDIR/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf" <<EOF
+        cat >"$DESTDIR/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf" <<EOF
 [Service]
 TTYVHangup=no
 CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
@@ -274,7 +274,7 @@ fi
 
 # Make sure services aren't enabled by default on Debian/Ubuntu.
 mkdir -p "$DESTDIR/etc/systemd/system-preset"
-echo "disable *" > "$DESTDIR/etc/systemd/system-preset/99-mkosi.preset"
+echo "disable *" >"$DESTDIR/etc/systemd/system-preset/99-mkosi.preset"
 
 if [ -d mkosi.kernel/ ]; then
         cd "$SRCDIR/mkosi.kernel"
diff --git a/mkosi.postinst b/mkosi.postinst
index fb59d311152..cebbf29250d 100755
--- a/mkosi.postinst
+++ b/mkosi.postinst
@@ -2,11 +2,11 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 if [ "$1" = "final" ]; then
-    if command -v bootctl > /dev/null && [ -d "/efi" ]; then
+    if command -v bootctl >/dev/null && [ -d "/efi" ]; then
         bootctl install
     fi
 
-    cat >> /root/.gdbinit <<EOF
+    cat >>/root/.gdbinit <<EOF
 set debuginfod enabled off
 set build-id-verbose 0
 EOF