diff --git a/.gitea/workflows/validate.yml b/.gitea/workflows/validate.yml
index 90e91c0..7288c3b 100644
--- a/.gitea/workflows/validate.yml
+++ b/.gitea/workflows/validate.yml
@@ -83,12 +83,18 @@ jobs:
         id: detect
         run: |
           set -e
-          if git diff --name-only HEAD~1 HEAD 2>/dev/null \
-              | grep -qE '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'; then
+          # Base inputs baked into Dockerfile.base: Dockerfile.base itself, any
+          # file under rootfs/ (COPYed into the base), and entrypoint*.sh. NB:
+          # rootfs/ is a PREFIX match — the earlier '^(...|rootfs/|...)$' anchored
+          # the whole group, so the rootfs/ branch only matched a file literally
+          # named 'rootfs/' and never real paths like rootfs/usr/.../x.py.
+          base_re='^(Dockerfile\.base$|rootfs/|entrypoint.*\.sh$)'
+          changed="$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep -E "$base_re" || true)"
+          if [ -n "$changed" ]; then
             echo "base_changed=true" >> "$GITHUB_OUTPUT"
             echo "::warning::This commit changes base-image inputs (Dockerfile.base, rootfs/, or entrypoint*.sh). validate.yml uses Hub's base-latest as the parent for variant builds, so the new base is NOT exercised by this workflow — validate-base/validate-omos are SKIPPED to avoid a false failure against the stale base-latest. Cut a release tag, or run a workflow_dispatch of docker-publish-split.yml against a test tag (e.g. v0.0.0-base-test, promote_latest=false) for end-to-end validation of the new base."
             echo "Changed base-input files:"
-            git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'
+            printf '%s\n' "$changed"
           else
             echo "base_changed=false" >> "$GITHUB_OUTPUT"
             echo "No base-image inputs changed in this commit — validate.yml fully exercises the published base-latest."
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 63ad51a..0ce98dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,7 +35,11 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
   The `base-change-warning` job now exports a `base_changed` output and those two
   jobs **skip** when base inputs changed, deferring full base validation to the
   release path (`docker-publish-split.yml`). The scary red becomes a neutral skip
-  plus the existing warning.
+  plus the existing warning. Also fixes the base-input detector itself: its
+  `^(…|rootfs/|…)$` regex anchored the whole alternation, so the `rootfs/` branch
+  only matched a file literally named `rootfs/` and never real paths like
+  `rootfs/usr/…/generate-config.py` — `rootfs/` is now a prefix match, so
+  rootfs-only base changes are detected too.
 
 ---