diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
index 09d9cb9..8f20c08 100644
--- a/.github/workflows/image.yaml
+++ b/.github/workflows/image.yaml
@@ -1,7 +1,11 @@
 name: Build Image
 on:
-  pull_request:
-    branches: [ main ]
+  pull_request_target:
+    types:
+      - labeled
+      - synchronize
+    branches:
+      - main
   push:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
@@ -55,6 +59,7 @@ jobs:
 
       # For pull requests, build and push platform-specific images
       - name: Build and push Docker image
+        if: github.event_name == 'push' || (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe to test'))
         uses: docker/build-push-action@v5
         with:
           context: .
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index 15b7d9e..2e8371e 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -1,8 +1,11 @@
 name: Integration Tests
 on:
-  pull_request:
   pull_request_target:
-    types: [labeled]
+    types:
+      - labeled
+      - synchronize
+    branches:
+      - main
   push:
     branches:
       - 'main'
@@ -31,7 +34,7 @@ jobs:
       with:
         go-version: '1.22'
     - run: make integration-test
-      if: github.event_name == 'push' || github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe to test'))
+      if: github.event_name == 'push' || (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe to test'))
       env:
         CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -46,4 +49,4 @@ jobs:
       if: github.event_name != 'pull_request_target'
       uses: codecov/codecov-action@v5
       with:
-        token: ${{ secrets.CODECOV_TOKEN }}
\ No newline at end of file
+        token: ${{ secrets.CODECOV_TOKEN }}