diff --git a/.github/workflows/actions-lint.yml b/.github/workflows/actions-lint.yml
index ae0eca96e..51ed22b85 100644
--- a/.github/workflows/actions-lint.yml
+++ b/.github/workflows/actions-lint.yml
@@ -18,6 +18,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/automated-end-to-end-api.yaml b/.github/workflows/automated-end-to-end-api.yaml
index 572661a8b..6ecebc640 100644
--- a/.github/workflows/automated-end-to-end-api.yaml
+++ b/.github/workflows/automated-end-to-end-api.yaml
@@ -23,6 +23,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/browser-testing.yml b/.github/workflows/browser-testing.yml
index 0501e9320..fae008cc9 100644
--- a/.github/workflows/browser-testing.yml
+++ b/.github/workflows/browser-testing.yml
@@ -24,6 +24,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/build-storybook.yml b/.github/workflows/build-storybook.yml
index a292bab37..239f793ac 100644
--- a/.github/workflows/build-storybook.yml
+++ b/.github/workflows/build-storybook.yml
@@ -21,6 +21,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
@@ -48,6 +49,7 @@ jobs:
           npm run build-storybook -- -o ../docs/components
 
       - name: Commit changes
+        if: github.repository == 'owncast/owncast'
         uses: EndBug/add-and-commit@v9
         with:
           author_name: Owncast
@@ -59,6 +61,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Dispatch event to web site
+        if: github.repository == 'owncast/owncast'
         uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.BUNDLE_STORYBOOK_OWNCAST_ONLINE }}
diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
index e8ec68177..a41310743 100644
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -7,7 +7,7 @@ on:
   push:
     paths:
       - web/**
-  pull_request_target:
+  pull_request:
     paths:
       - web/**
 
@@ -16,7 +16,6 @@ jobs:
   chromatic-deployment:
     # Operating System
     runs-on: ubuntu-latest
-    if: github.repository == 'owncast/owncast'
 
     defaults:
       run:
@@ -28,15 +27,16 @@ jobs:
         with:
           concurrent_skipping: 'same_content_newer'
 
-      - name: Check out pull request code
-        uses: actions/checkout@v4
-        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Check out repository code
-        uses: actions/checkout@v4
+      - name: Check out repository code (Push)
         if: github.event_name == 'push'
+        uses: actions/checkout@v4
+
+      - name: Check out pull request code (PR)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Get changed files
         id: changed-files-yaml
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d8607b68e..b359eb1f0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -41,6 +41,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/container-lint.yml b/.github/workflows/container-lint.yml
index 88c765e05..3ba398155 100644
--- a/.github/workflows/container-lint.yml
+++ b/.github/workflows/container-lint.yml
@@ -24,6 +24,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/container.yaml b/.github/workflows/container.yaml
index 41dd97438..04ad2eca9 100644
--- a/.github/workflows/container.yaml
+++ b/.github/workflows/container.yaml
@@ -42,6 +42,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/css-lint.yaml b/.github/workflows/css-lint.yaml
index 5d160968c..a9ab9be71 100644
--- a/.github/workflows/css-lint.yaml
+++ b/.github/workflows/css-lint.yaml
@@ -21,6 +21,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/generate-api-documentation.yaml b/.github/workflows/generate-api-documentation.yaml
index d402f69ef..9719bd44c 100644
--- a/.github/workflows/generate-api-documentation.yaml
+++ b/.github/workflows/generate-api-documentation.yaml
@@ -14,6 +14,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/hls-tests.yml b/.github/workflows/hls-tests.yml
index c381b91cd..f8db42b37 100644
--- a/.github/workflows/hls-tests.yml
+++ b/.github/workflows/hls-tests.yml
@@ -30,6 +30,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/.github/workflows/javascript-format-test-build.yml b/.github/workflows/javascript-format-test-build.yml
index 55db61b34..46b78f35d 100644
--- a/.github/workflows/javascript-format-test-build.yml
+++ b/.github/workflows/javascript-format-test-build.yml
@@ -121,6 +121,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
@@ -191,6 +192,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4