diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index b6f54b2..03f76bc 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -1,6 +1,9 @@
 name: Pull Request Checks
 
-on: [ push ]
+on:
+  pull_request:
+    branches:
+      - main
 
 jobs:
   code-quality:
diff --git a/.github/workflows/release-staging.yaml b/.github/workflows/release-staging.yaml
index 971a5af..82d545c 100644
--- a/.github/workflows/release-staging.yaml
+++ b/.github/workflows/release-staging.yaml
@@ -1,7 +1,9 @@
 name: Release on Staging
 
 on:
-  push:
+  pull_request:
+    types:
+      - closed
     branches:
       - main
 
@@ -14,5 +16,8 @@ jobs:
     uses: ./.github/workflows/test.yaml
   publish:
     name: Publish staging release
+    permissions:
+      id-token: write
+      pages: write
     uses: ./.github/workflows/publish-test.yaml
     needs: [code-quality, test]
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ec42296..f993628 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -8,4 +8,6 @@ on:
 jobs:
   publish:
     name: Publish release
+    permissions:
+      id-token: write
     uses: ./.github/workflows/publish.yaml
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index aa6ae4e..1d02d95 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,7 +5,6 @@ on:
 
 jobs:
   unit-test:
-
     runs-on: ubuntu-latest
     strategy:
       matrix: