diff --git a/.github/.gitkeep b/.github/.gitkeep
new file mode 100644
index 00000000000..21c3fc0e380
--- /dev/null
+++ b/.github/.gitkeep
@@ -0,0 +1 @@
+Just a file to make this branch different from the main PM-15126 branch.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index b50cb807448..a4dfa94c84f 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -85,9 +85,13 @@ apps/web/src/app/shared @bitwarden/team-platform-dev
 apps/web/src/translation-constants.ts @bitwarden/team-platform-dev
 # Workflows
 .github/workflows/brew-bump-desktop.yml @bitwarden/team-platform-dev
+.github/workflows/build-browser-target.yml @bitwarden/team-platform-dev
 .github/workflows/build-browser.yml @bitwarden/team-platform-dev
+.github/workflows/build-cli-target.yml @bitwarden/team-platform-dev
 .github/workflows/build-cli.yml @bitwarden/team-platform-dev
+.github/workflows/build-desktop-target.yml @bitwarden/team-platform-dev
 .github/workflows/build-desktop.yml @bitwarden/team-platform-dev
+.github/workflows/build-web-target.yml @bitwarden/team-platform-dev
 .github/workflows/build-web.yml @bitwarden/team-platform-dev
 .github/workflows/chromatic.yml @bitwarden/team-platform-dev
 .github/workflows/lint.yml @bitwarden/team-platform-dev
diff --git a/.github/workflows/build-browser-target.yml b/.github/workflows/build-browser-target.yml
new file mode 100644
index 00000000000..12a08cf50a3
--- /dev/null
+++ b/.github/workflows/build-browser-target.yml
@@ -0,0 +1,39 @@
+name: Build Browser on PR Target
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+    branches-ignore:
+      - 'l10n_master'
+      - 'cf-pages'
+    paths:
+      - 'apps/browser/**'
+      - 'libs/**'
+      - '*'
+      - '!*.md'
+      - '!*.txt'
+  workflow_call:
+    inputs: {}
+  workflow_dispatch:
+    inputs:
+      sdk_branch:
+        description: "Custom SDK branch"
+        required: false
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  run-workflow:
+    name: Run Build Browser on PR Target
+    needs: check-run
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/build-browser.yml
+    secrets: inherit
+
diff --git a/.github/workflows/build-browser.yml b/.github/workflows/build-browser.yml
index 7740e418e7b..20e2d261c99 100644
--- a/.github/workflows/build-browser.yml
+++ b/.github/workflows/build-browser.yml
@@ -1,7 +1,7 @@
 name: Build Browser
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -38,8 +38,27 @@ defaults:
     shell: bash
 
 jobs:
+  check-secrets:
+    name: Check Secrets
+    runs-on: ubuntu-22.04
+    outputs:
+      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
+    steps:
+      - name: Check secrets
+        id: check-secrets
+        env:
+          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+        run: |
+          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
+          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
+
+  # Enforce permissions _if_ the workflow has access to secrets to avoid
+  # bots having unsupervised access to secrets.
   check-run:
     name: Check PR run
+    needs:
+      - check-secrets
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
 
   setup:
@@ -281,6 +300,7 @@ jobs:
     needs:
       - setup
       - locales-test
+    if: ${{ needs.setup.outputs.has_secrets == 'true' }}
     env:
       _BUILD_NUMBER: ${{ needs.setup.outputs.adj_build_number }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
diff --git a/.github/workflows/build-cli-target.yml b/.github/workflows/build-cli-target.yml
new file mode 100644
index 00000000000..89f8b63b525
--- /dev/null
+++ b/.github/workflows/build-cli-target.yml
@@ -0,0 +1,39 @@
+name: Build CLI on PR Target
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+    branches-ignore:
+      - 'l10n_master'
+      - 'cf-pages'
+    paths:
+      - 'apps/cli/**'
+      - 'libs/**'
+      - '*'
+      - '!*.md'
+      - '!*.txt'
+      - '.github/workflows/build-cli.yml'
+      - 'bitwarden_license/bit-cli/**'
+  workflow_dispatch:
+    inputs:
+      sdk_branch:
+        description: "Custom SDK branch"
+        required: false
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  run-workflow:
+    name: Run Build CLI on PR Target
+    needs: check-run
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/build-cli.yml
+    secrets: inherit
+
diff --git a/.github/workflows/build-cli.yml b/.github/workflows/build-cli.yml
index d480879fb15..39161f94a29 100644
--- a/.github/workflows/build-cli.yml
+++ b/.github/workflows/build-cli.yml
@@ -1,7 +1,7 @@
 name: Build CLI
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -27,6 +27,8 @@ on:
       - '!*.txt'
       - '.github/workflows/build-cli.yml'
       - 'bitwarden_license/bit-cli/**'
+  workflow_call:
+    inputs: {}
   workflow_dispatch:
     inputs:
       sdk_branch:
@@ -39,8 +41,27 @@ defaults:
     working-directory: apps/cli
 
 jobs:
+  check-secrets:
+    name: Check Secrets
+    runs-on: ubuntu-22.04
+    outputs:
+      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
+    steps:
+      - name: Check secrets
+        id: check-secrets
+        env:
+          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+        run: |
+          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
+          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
+
+  # Enforce permissions _if_ the workflow has access to secrets to avoid
+  # bots having unsupervised access to secrets.
   check-run:
     name: Check PR run
+    needs:
+      - check-secrets
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
 
   setup:
@@ -87,6 +108,7 @@ jobs:
           ]
     runs-on: ${{ matrix.os.distro }}
     needs:
+      - check-secrets
       - setup
     env:
       _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
@@ -117,7 +139,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -130,7 +152,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.` == 'true' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -187,6 +209,7 @@ jobs:
           ]
     runs-on: windows-2022
     needs:
+      - check-secrets
       - setup
     env:
       _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
@@ -272,7 +295,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -285,7 +308,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         working-directory: ./
         run: |
           ls -l ../
diff --git a/.github/workflows/build-desktop-target.yml b/.github/workflows/build-desktop-target.yml
new file mode 100644
index 00000000000..b9ea9cacb8d
--- /dev/null
+++ b/.github/workflows/build-desktop-target.yml
@@ -0,0 +1,38 @@
+name: Build Desktop on PR Target
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+    branches-ignore:
+      - 'l10n_master'
+      - 'cf-pages'
+    paths:
+      - 'apps/desktop/**'
+      - 'libs/**'
+      - '*'
+      - '!*.md'
+      - '!*.txt'
+      - '.github/workflows/build-desktop.yml'
+  workflow_dispatch:
+    inputs:
+      sdk_branch:
+        description: "Custom SDK branch"
+        required: false
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  run-workflow:
+    name: Run Build Desktop on PR Target
+    needs: check-run
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/build-desktop.yml
+    secrets: inherit
+
diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index bc9bdec396a..b9842d92cc3 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -1,7 +1,7 @@
 name: Build Desktop
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -25,6 +25,8 @@ on:
       - '!*.md'
       - '!*.txt'
       - '.github/workflows/build-desktop.yml'
+  workflow_call:
+    inputs: {}
   workflow_dispatch:
     inputs:
       sdk_branch:
@@ -37,15 +39,32 @@ defaults:
     shell: bash
 
 jobs:
+  check-secrets:
+    name: Check Secrets
+    runs-on: ubuntu-22.04
+    outputs:
+      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
+    steps:
+      - name: Check secrets
+        id: check-secrets
+        env:
+          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+        run: |
+          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
+          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
+
+  # Enforce permissions _if_ the workflow has access to secrets to avoid
+  # bots having unsupervised access to secrets.
   check-run:
     name: Check PR run
+    needs:
+      - check-secrets
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
 
   electron-verify:
     name: Verify Electron Version
     runs-on: ubuntu-22.04
-    needs:
-      - check-run
     steps:
       - name: Check out repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -291,6 +310,7 @@ jobs:
     name: Windows Build
     runs-on: windows-2022
     needs:
+      - check-secrets
       - setup
     defaults:
       run:
@@ -333,12 +353,14 @@ jobs:
           rustup show
 
       - name: Login to Azure
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
 
       - name: Retrieve secrets
         id: retrieve-secrets
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
         with:
           keyvault: "bitwarden-ci"
@@ -353,7 +375,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -366,7 +388,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -386,7 +408,17 @@ jobs:
         working-directory: apps/desktop/desktop_native
         run: node build.js cross-platform
 
-      - name: Build & Sign (dev)
+      - name: Build
+        run: |
+          npm run build
+
+      - name: Pack
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'false' }}
+        run: |
+          npm run pack:win
+
+      - name: Pack & Sign (dev)
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         env:
           ELECTRON_BUILDER_SIGN: 1
           SIGNING_VAULT_URL: ${{ steps.retrieve-secrets.outputs.code-signing-vault-url }}
@@ -395,10 +427,10 @@ jobs:
           SIGNING_CLIENT_SECRET: ${{ steps.retrieve-secrets.outputs.code-signing-client-secret }}
           SIGNING_CERT_NAME: ${{ steps.retrieve-secrets.outputs.code-signing-cert-name }}
         run: |
-          npm run build
           npm run pack:win
 
       - name: Rename appx files for store
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         run: |
           Copy-Item "./dist/Bitwarden-${{ env._PACKAGE_VERSION }}-ia32.appx" `
             -Destination "./dist/Bitwarden-${{ env._PACKAGE_VERSION }}-ia32-store.appx"
@@ -408,6 +440,7 @@ jobs:
             -Destination "./dist/Bitwarden-${{ env._PACKAGE_VERSION }}-arm64-store.appx"
 
       - name: Package for Chocolatey
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         run: |
           Copy-Item -Path ./stores/chocolatey -Destination ./dist/chocolatey -Recurse
           Copy-Item -Path ./dist/nsis-web/Bitwarden-Installer-${{ env._PACKAGE_VERSION }}.exe `
@@ -419,6 +452,7 @@ jobs:
           choco pack ./dist/chocolatey/bitwarden.nuspec --version "$env:_PACKAGE_VERSION" --out ./dist/chocolatey
 
       - name: Fix NSIS artifact names for auto-updater
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         run: |
           Rename-Item -Path .\dist\nsis-web\Bitwarden-${{ env._PACKAGE_VERSION }}-ia32.nsis.7z `
             -NewName bitwarden-${{ env._PACKAGE_VERSION }}-ia32.nsis.7z
@@ -435,6 +469,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload installer exe artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-Installer-${{ env._PACKAGE_VERSION }}.exe
@@ -442,6 +477,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload appx ia32 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-ia32.appx
@@ -449,6 +485,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload store appx ia32 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-ia32-store.appx
@@ -456,6 +493,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload NSIS ia32 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden-${{ env._PACKAGE_VERSION }}-ia32.nsis.7z
@@ -463,6 +501,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload appx x64 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-x64.appx
@@ -470,6 +509,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload store appx x64 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-x64-store.appx
@@ -477,6 +517,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload NSIS x64 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden-${{ env._PACKAGE_VERSION }}-x64.nsis.7z
@@ -484,6 +525,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload appx ARM64 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-arm64.appx
@@ -491,6 +533,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload store appx ARM64 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Bitwarden-${{ env._PACKAGE_VERSION }}-arm64-store.appx
@@ -498,6 +541,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload NSIS ARM64 artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden-${{ env._PACKAGE_VERSION }}-arm64.nsis.7z
@@ -505,6 +549,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload nupkg artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: bitwarden.${{ env._PACKAGE_VERSION }}.nupkg
@@ -512,6 +557,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload auto-update artifact
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ needs.setup.outputs.release_channel }}.yml
@@ -523,6 +569,7 @@ jobs:
     name: MacOS Build
     runs-on: macos-13
     needs:
+      - check-secrets
       - setup
     env:
       _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
@@ -574,11 +621,13 @@ jobs:
           key: ${{ runner.os }}-${{ github.run_id }}-safari-extension
 
       - name: Login to Azure
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
 
       - name: Download Provisioning Profiles secrets
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         env:
           ACCOUNT_NAME: bitwardenci
           CONTAINER_NAME: profiles
@@ -591,6 +640,7 @@ jobs:
             --output none
 
       - name: Get certificates
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         run: |
           mkdir -p $HOME/certificates
 
@@ -613,6 +663,7 @@ jobs:
             jq -r .value | base64 -d > $HOME/certificates/macdev-cert.p12
 
       - name: Set up keychain
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         env:
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
         run: |
@@ -642,6 +693,7 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain
 
       - name: Set up provisioning profiles
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         run: |
           cp $HOME/secrets/bitwarden_desktop_appstore.provisionprofile \
             $GITHUB_WORKSPACE/apps/desktop/bitwarden_desktop_appstore.provisionprofile
@@ -661,7 +713,7 @@ jobs:
         working-directory: ./
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -674,7 +726,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -700,7 +752,10 @@ jobs:
 
   browser-build:
     name: Browser Build
-    needs: setup
+    needs:
+      - check-secrets
+      - setup
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     uses: ./.github/workflows/build-browser.yml
     secrets: inherit
 
@@ -709,9 +764,11 @@ jobs:
     name: MacOS Package GitHub Release Assets
     runs-on: macos-13
     needs:
+      - check-secrets
       - browser-build
       - macos-build
       - setup
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     env:
       _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
@@ -950,9 +1007,11 @@ jobs:
     name: MacOS Package Prod Release Asset
     runs-on: macos-13
     needs:
+      - check-secrets
+      - setup
       - browser-build
       - macos-build
-      - setup
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     env:
       _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
@@ -1216,10 +1275,12 @@ jobs:
   macos-package-dev:
     name: MacOS Package Dev Release Asset
     runs-on: macos-13
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     needs:
+      - check-secrets
+      - setup
       - browser-build
       - macos-build
-      - setup
     env:
       _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
       _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
diff --git a/.github/workflows/build-web-target.yml b/.github/workflows/build-web-target.yml
new file mode 100644
index 00000000000..9a9cd735435
--- /dev/null
+++ b/.github/workflows/build-web-target.yml
@@ -0,0 +1,41 @@
+name: Build Web on PR Target
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+    branches-ignore:
+      - 'l10n_master'
+      - 'cf-pages'
+    paths:
+      - 'apps/web/**'
+      - 'libs/**'
+      - '*'
+      - '!*.md'
+      - '!*.txt'
+      - '.github/workflows/build-web.yml'
+  workflow_dispatch:
+    inputs:
+      custom_tag_extension:
+        description: "Custom image tag extension"
+        required: false
+      sdk_branch:
+        description: "Custom SDK branch"
+        required: false
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  run-workflow:
+    name: Run Build Web on PR Target
+    needs: check-run
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/build-web.yml
+    secrets: inherit
+
diff --git a/.github/workflows/build-web.yml b/.github/workflows/build-web.yml
index 6e5e11c3361..cb9ec2ce071 100644
--- a/.github/workflows/build-web.yml
+++ b/.github/workflows/build-web.yml
@@ -1,7 +1,7 @@
 name: Build Web
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
@@ -27,6 +27,8 @@ on:
       - '.github/workflows/build-web.yml'
   release:
     types: [published]
+  workflow_call:
+    inputs: {}
   workflow_dispatch:
     inputs:
       custom_tag_extension:
@@ -41,15 +43,46 @@ env:
   _AZ_REGISTRY: bitwardenprod.azurecr.io
 
 jobs:
+  check-secrets:
+    name: Check Secrets
+    runs-on: ubuntu-22.04
+    outputs:
+      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
+    steps:
+      - name: Check secrets
+        id: check-secrets
+        env:
+          AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+        run: |
+          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
+          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
+
+  # Enforce permissions _if_ the workflow has access to secrets to avoid
+  # bots having unsupervised access to secrets.
   check-run:
     name: Check PR run
+    needs:
+      - check-secrets
+    if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
 
+  allowed-to-run:
+    name: Stop job if not allowed to run
+    needs:
+      - check-secrets
+      - check-run
+    if: always()
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Fail
+        if: ${{ needs.check-run.result == 'failure' }}
+        run: exit 1
+
   setup:
     name: Setup
     runs-on: ubuntu-22.04
     needs:
-      - check-run
+      - allowed-to-run
     outputs:
       version: ${{ steps.version.outputs.value }}
       node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
@@ -74,6 +107,7 @@ jobs:
     name: Build artifacts
     runs-on: ubuntu-22.04
     needs:
+      - check-secrets
       - setup
     env:
       _VERSION: ${{ needs.setup.outputs.version }}
@@ -128,7 +162,7 @@ jobs:
         run: npm ci
 
       - name: Download SDK Artifacts
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: bitwarden/gh-actions/download-artifacts@main
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -141,7 +175,7 @@ jobs:
           if_no_artifact_found: fail
 
       - name: Override SDK
-        if: ${{ inputs.sdk_branch != '' }}
+        if: ${{ inputs.sdk_branch != '' && needs.check-secrets.outputs.has_secrets == 'true' }}
         working-directory: ./
         run: |
           ls -l ../
@@ -175,6 +209,7 @@ jobs:
     name: Build Docker images
     runs-on: ubuntu-22.04
     needs:
+      - check-secrets
       - setup
       - build-artifacts
     strategy:
@@ -210,19 +245,23 @@ jobs:
 
       ########## ACRs ##########
       - name: Login to Prod Azure
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }}
 
       - name: Log into Prod container registry
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         run: az acr login -n bitwardenprod
 
       - name: Login to Azure - CI Subscription
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
           creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
 
       - name: Retrieve github PAT secrets
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         id: retrieve-secret-pat
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
         with:
@@ -270,6 +309,7 @@ jobs:
         run: echo "name=$_AZ_REGISTRY/${PROJECT_NAME}:${IMAGE_TAG}" >> $GITHUB_OUTPUT
 
       - name: Build Docker image
+        if: ${{ needs.check-secrets.outputs.has_secrets == 'true' }}
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           context: apps/web
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 9dc72c7fdda..1b738bd7bcf 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,12 +1,20 @@
 name: Lint
 
 on:
-  push:
+  pull_request:
+    types: [opened, synchronize]
     branches-ignore:
       - 'l10n_master'
       - 'cf-pages'
     paths-ignore:
       - '.github/workflows/**'
+  push:
+    branches:
+      - 'main'
+      - 'rc'
+      - 'hotfix-rc-*'
+    paths-ignore:
+      - '.github/workflows/**'
   workflow_dispatch:
     inputs: {}