diff --git a/.github/workflows/api-spec.yml b/.github/workflows/api-spec.yml
index 21e643d..ba00c4a 100644
--- a/.github/workflows/api-spec.yml
+++ b/.github/workflows/api-spec.yml
@@ -34,16 +34,17 @@ jobs:
           key: vendor-php8.4-${{ hashFiles('composer.lock') }}
           restore-keys: vendor-php8.4-
 
-      # https://taskfile.dev/installation/#github-actions
-      - uses: go-task/setup-task@v2
-
-      - run: |
+      - name: Install dependencies
+        run: |
           docker network create frontend
-          task --yes site:update
+          # The spec export only needs PHP — pull phpfpm alone and run it as a
+          # one-off (--no-deps skips mariadb/rabbit), not the whole stack.
+          docker compose pull --quiet phpfpm
+          docker compose run --rm --no-deps phpfpm composer install --no-interaction
 
       - name: Export API specification
         run: |
-          task --yes api:spec:export
+          docker compose run --rm --no-deps phpfpm bin/console api:openapi:export --yaml --output=public/spec.yaml --no-interaction
 
       - name: Check for changes in specification
         id: git-diff-spec
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index e6b184a..b83d147 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -23,8 +23,10 @@ jobs:
       - name: Start docker compose setup and install site
         run: |
           docker network create frontend
-          docker compose pull --quiet
-          docker compose up --detach --wait
+          # API tests need PHP + Elasticsearch only (not mariadb/rabbit/nginx/mail);
+          # --no-deps keeps phpfpm's mariadb/rabbit dependencies from starting.
+          docker compose pull --quiet phpfpm elasticsearch
+          docker compose up --detach --wait --no-deps phpfpm elasticsearch
           docker compose exec -T phpfpm composer install --no-interaction
 
       - name: Load test fixtures
@@ -58,16 +60,16 @@ jobs:
           key: vendor-php8.4-${{ hashFiles('composer.lock') }}
           restore-keys: vendor-php8.4-
 
-      - name: Start docker compose setup and install site
+      - name: Install dependencies
         run: |
           docker network create frontend
-          docker compose pull --quiet
-          docker compose up --detach --wait
-          docker compose exec -T phpfpm composer install --no-interaction
+          # PHPStan only needs PHP — pull phpfpm and run it as a one-off (--no-deps).
+          docker compose pull --quiet phpfpm
+          docker compose run --rm --no-deps phpfpm composer install --no-interaction
 
       - name: Run code analysis
         run: |
-          docker compose exec -T phpfpm vendor/bin/phpstan analyse --no-progress
+          docker compose run --rm --no-deps phpfpm vendor/bin/phpstan analyse --no-progress
 
   code-analysis-rector:
     runs-on: ubuntu-latest
@@ -82,13 +84,13 @@ jobs:
           key: vendor-php8.4-${{ hashFiles('composer.lock') }}
           restore-keys: vendor-php8.4-
 
-      - name: Start docker compose setup and install site
+      - name: Install dependencies
         run: |
           docker network create frontend
-          docker compose pull --quiet
-          docker compose up --detach --wait
-          docker compose exec -T phpfpm composer install --no-interaction
+          # Rector only needs PHP — pull phpfpm and run it as a one-off (--no-deps).
+          docker compose pull --quiet phpfpm
+          docker compose run --rm --no-deps phpfpm composer install --no-interaction
 
       - name: Check for Rector suggestions
         run: |
-          docker compose exec -T phpfpm vendor/bin/rector process --dry-run --no-progress-bar
+          docker compose run --rm --no-deps phpfpm vendor/bin/rector process --dry-run --no-progress-bar
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ff617e..3a4d74b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ See [keep a changelog] for information about writing changes to this log.
 
 ## [Unreleased]
 
+- [PR-56](https://github.com/itk-dev/event-database-api/pull/56)
+  Scope CI image pulls to each job's real dependencies (phpfpm, or phpfpm + elasticsearch) instead of the whole stack
 - [PR-55](https://github.com/itk-dev/event-database-api/pull/55)
   Self-heal the API-spec "up to date" PR comment (resolve to ✅ once the spec matches, no stale 🛑)
 - [PR-54](https://github.com/itk-dev/event-database-api/pull/54)