diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 3aefe38..ff57ad0 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -1,99 +1,94 @@
-name: build-and-push
+name: build-and-deploy
 
 on:
   push:
     branches: [ main ]
 
 jobs:
-  build:
-    runs-on: docker
+#───────────────── filtra qué dirs cambiaron ─────────────────
+  filter:
+    runs-on: ubuntu-latest
+    outputs:
+      agent:  ${{ steps.paths.outputs.agent }}
+      api:    ${{ steps.paths.outputs.api }}
+      mcp:    ${{ steps.paths.outputs.mcp }}
+      ui:     ${{ steps.paths.outputs.ui }}
+      worker: ${{ steps.paths.outputs.worker }}
     steps:
       - uses: actions/checkout@v3
+      - id: paths
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            agent:  "agent/**"
+            api:    "api/**"
+            mcp:    "mcp/**"
+            ui:     "ui/**"
+            worker: "worker/**"
 
+#───────────────── build & push ─────────────────
+  build:
+    needs: filter
+    runs-on: docker
+    env:
+      REG: gitea.interno.com/nucleo000
+    steps:
+      - uses: actions/checkout@v3
       - uses: docker/setup-buildx-action@v2
-
-      - name: Login to registry
-        uses: docker/login-action@v2
+      - uses: docker/login-action@v2
         with:
           registry: gitea.interno.com
           username: nucleo000           # ⬅ ponelo en secrets
-          password: 7bc7b2fcd283bd6a251bef3ede368b7f897c919d # ⬅ idem
+          password: 7bc7b2fcd283bd6a251bef3ede368b7f897c919d # ⬅ idem          username: ${{ secrets.REGISTRY_USER }}
 
-      # ──────────────── builds ────────────────
-      # - name: Build root image
-      #   run: |
-      #     docker build -f ./Dockerfile \
-      #       -t gitea.interno.com/nucleo000/planilla:${{ github.sha }} \
-      #       -t gitea.interno.com/nucleo000/planilla:latest .
-
-      - name: Build AGENT image
+      - name: Build+push agent
+        if: needs.filter.outputs.agent == 'true'
         run: |
-          docker build -f ./agent/Dockerfile \
-            -t gitea.interno.com/nucleo000/planilla-agent:${{ github.sha }} \
-            -t gitea.interno.com/nucleo000/planilla-agent:latest \
-            ./agent
+          docker build -f agent/Dockerfile -t $REG/planilla-agent:${{ github.sha }} -t $REG/planilla-agent:latest agent
+          docker push $REG/planilla-agent:${{ github.sha }}
+          docker push $REG/planilla-agent:latest
 
-      - name: Build API image
+      - name: Build+push api
+        if: needs.filter.outputs.api == 'true'
         run: |
-          docker build -f ./api/Dockerfile \
-            -t gitea.interno.com/nucleo000/planilla-api:${{ github.sha }} \
-            -t gitea.interno.com/nucleo000/planilla-api:latest \
-            ./api
+          docker build -f api/Dockerfile -t $REG/planilla-api:${{ github.sha }} -t $REG/planilla-api:latest api
+          docker push $REG/planilla-api:${{ github.sha }}
+          docker push $REG/planilla-api:latest
 
-      - name: Build MCP image
+      - name: Build+push mcp
+        if: needs.filter.outputs.mcp == 'true'
         run: |
-          docker build -f ./mcp/Dockerfile \
-            -t gitea.interno.com/nucleo000/planilla-mcp:${{ github.sha }} \
-            -t gitea.interno.com/nucleo000/planilla-mcp:latest \
-            ./mcp
+          docker build -f mcp/Dockerfile -t $REG/planilla-mcp:${{ github.sha }} -t $REG/planilla-mcp:latest mcp
+          docker push $REG/planilla-mcp:${{ github.sha }}
+          docker push $REG/planilla-mcp:latest
 
-      - name: Build UI image
+      - name: Build+push ui
+        if: needs.filter.outputs.ui == 'true'
         run: |
-          docker build -f ./ui/Dockerfile \
-            -t gitea.interno.com/nucleo000/planilla-ui:${{ github.sha }} \
-            -t gitea.interno.com/nucleo000/planilla-ui:latest \
-            ./ui
+          docker build -f ui/Dockerfile -t $REG/planilla-ui:${{ github.sha }} -t $REG/planilla-ui:latest ui
+          docker push $REG/planilla-ui:${{ github.sha }}
+          docker push $REG/planilla-ui:latest
 
-      - name: Build WORKER image
+      - name: Build+push worker
+        if: needs.filter.outputs.worker == 'true'
         run: |
-          docker build -f ./worker/Dockerfile \
-            -t gitea.interno.com/nucleo000/planilla-worker:${{ github.sha }} \
-            -t gitea.interno.com/nucleo000/planilla-worker:latest \
-            ./worker
-
-      # ──────────────── push loop ────────────────
-      - name: Push images
-        run: |
-          for img in planilla-agent \
-                     planilla-api \
-                     planilla-mcp \
-                     planilla-ui \
-                     planilla-worker; do
-            docker push gitea.interno.com/nucleo000/$img:${{ github.sha }}
-            docker push gitea.interno.com/nucleo000/$img:latest
-          done
+          docker build -f worker/Dockerfile -t $REG/planilla-worker:${{ github.sha }} -t $REG/planilla-worker:latest worker
+          docker push $REG/planilla-worker:${{ github.sha }}
+          docker push $REG/planilla-worker:latest
 
+#───────────────── deploy ─────────────────
   deploy:
-    runs-on: docker
     needs: build
+    runs-on: docker
+    env:
+      REG: gitea.interno.com/nucleo000
     steps:
       - uses: actions/checkout@v3
-
       - name: Login to registry
-        run: docker login gitea.interno.com -u nucleo000 -p 7bc7b2fcd283bd6a251bef3ede368b7f897c919d
+        run: docker login gitea.interno.com -u ${{ secrets.REGISTRY_USER }} -p ${{ secrets.REGISTRY_PASS }}
 
-      - name: Pull latest images
-        run: |
-          for img in planilla-agent \
-                     planilla-api \
-                     planilla-mcp \
-                     planilla-ui \
-                     planilla-worker; do
-            docker pull gitea.interno.com/nucleo000/$img:latest
-          done
+      - name: Pull fresh images used in compose
+        run: docker compose pull
 
-      - name: Teardown previous stack
-        run: docker compose down --remove-orphans || true
-
-      - name: Start all services fresh
-        run: docker compose up -d --build --force-recreate --remove-orphans
+      - name: Update stack
+        run: docker compose up -d --remove-orphans --wait