diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index c72de32..44c1fdb 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -1,5 +1,11 @@
 name: check
-on: [push, pull_request, merge_group]
+on:
+  pull_request:
+    branches:
+    - main
+  merge_group:
+    branches:
+    - main
 jobs:
   fmt:
     name: fmt
diff --git a/.github/workflows/client.yml b/.github/workflows/client.yml
index 44cb0a7..9bdbabc 100644
--- a/.github/workflows/client.yml
+++ b/.github/workflows/client.yml
@@ -1,5 +1,11 @@
 name: client
-on: [push, pull_request, merge_group]
+on:
+  pull_request:
+    branches:
+    - main
+  merge_group:
+    branches:
+    - main
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/kernel.yml b/.github/workflows/kernel.yml
index 95da3d7..03310c8 100644
--- a/.github/workflows/kernel.yml
+++ b/.github/workflows/kernel.yml
@@ -1,15 +1,14 @@
 name: kernel
 on:
-  push:
-    paths:
-    - "kernel/**"
-    - "hack/ci/**"
   pull_request:
+    branches:
+    - main
     paths:
     - "kernel/**"
     - "hack/ci/**"
   merge_group:
-
+    branches:
+    - main
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/os.yml b/.github/workflows/os.yml
index edd41ae..81131a1 100644
--- a/.github/workflows/os.yml
+++ b/.github/workflows/os.yml
@@ -1,16 +1,15 @@
 name: os
 on:
-  push:
-    paths:
-    - "os/**"
-    - "hack/os/**"
-    - "hack/ci/**"
   pull_request:
+    branches:
+    - main
     paths:
     - "os/**"
     - "hack/os/**"
     - "hack/ci/**"
   merge_group:
+    branches:
+    - main
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 5ce491a..b0a1820 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -1,18 +1,13 @@
 name: release-plz
-
 permissions:
   pull-requests: write
   contents: write
-
 on:
   push:
     branches:
     - main
-
 concurrency:
   group: "${{ github.workflow }}"
-  cancel-in-progress: true
-
 jobs:
   release-plz:
     name: release-plz
@@ -27,6 +22,7 @@ jobs:
         with:
           submodules: recursive
           fetch-depth: 0
+          token: "${{ steps.generate-token.outputs.token }}"
       - uses: dtolnay/rust-toolchain@stable
       - run: ./hack/ci/install-linux-deps.sh
       - name: release-plz
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
index 5d7da42..4f7e72d 100644
--- a/.github/workflows/server.yml
+++ b/.github/workflows/server.yml
@@ -1,5 +1,11 @@
 name: server
-on: [push, pull_request, merge_group]
+on:
+  pull_request:
+    branches:
+    - main
+  merge_group:
+    branches:
+    - main
 jobs:
   build:
     runs-on: ubuntu-latest