diff --git a/.github/workflows/_backstop-docker-ci.yml b/.github/workflows/_backstop-docker-ci.yml
index f81da740c..2c89b1587 100644
--- a/.github/workflows/_backstop-docker-ci.yml
+++ b/.github/workflows/_backstop-docker-ci.yml
@@ -12,13 +12,14 @@ on:
     branches: [master, develop]
 
 permissions:
+  actions: write
   checks: write
   contents: write
   pull-requests: write
   packages: write
 
 env:
-  BRANCH_NAME: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
+  BRANCH_NAME: ${{ github.event.pull_request.head.sha || github.head_ref || github.ref_name }}
 
 jobs:
   backstop-sanity-test:
diff --git a/.github/workflows/backstop-integration-test.yml b/.github/workflows/backstop-integration-test.yml
index da07a994d..dc780ab6b 100644
--- a/.github/workflows/backstop-integration-test.yml
+++ b/.github/workflows/backstop-integration-test.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   contents: write
   pull-requests: write
 
@@ -20,7 +21,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: ⬢ Setup Node & Cache
         uses: actions/setup-node@v4
diff --git a/.github/workflows/backstop-sanity-test.yml b/.github/workflows/backstop-sanity-test.yml
index 6e74932f5..f6877aa8e 100644
--- a/.github/workflows/backstop-sanity-test.yml
+++ b/.github/workflows/backstop-sanity-test.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   contents: write
   pull-requests: write
 
@@ -20,7 +21,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: ⬢ Setup Node & Cache
         uses: actions/setup-node@v4
@@ -43,7 +44,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: ⬢ Setup Node & Cache
         uses: actions/setup-node@v4
diff --git a/.github/workflows/backstop-smoke-test.yml b/.github/workflows/backstop-smoke-test.yml
index 7157b0fea..f71e1c42c 100644
--- a/.github/workflows/backstop-smoke-test.yml
+++ b/.github/workflows/backstop-smoke-test.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   contents: write
   pull-requests: write
 
@@ -20,7 +21,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: ⬢ Setup Node & Cache
         uses: actions/setup-node@v4
@@ -44,7 +45,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: ⬢ Setup Node & Cache
         uses: actions/setup-node@v4
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index dd146cdf9..7c539b7b3 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   checks: write
   contents: write
   pull-requests: write
@@ -26,7 +27,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set Name and Tag Vars
         env:
diff --git a/.github/workflows/docker-sanity-test.yml b/.github/workflows/docker-sanity-test.yml
index cd3957fb1..bff8160b7 100644
--- a/.github/workflows/docker-sanity-test.yml
+++ b/.github/workflows/docker-sanity-test.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   checks: write
   contents: write
   pull-requests: write
@@ -30,7 +31,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set Name and Tag Vars
         env:
@@ -78,7 +79,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set Name and Tag Vars
         env:
diff --git a/.github/workflows/docker-smoke-test.yml b/.github/workflows/docker-smoke-test.yml
index 20bf5d7c3..46cf131da 100644
--- a/.github/workflows/docker-smoke-test.yml
+++ b/.github/workflows/docker-smoke-test.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   checks: write
   contents: write
   pull-requests: write
@@ -30,7 +31,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set Name and Tag Vars
         env:
@@ -78,7 +79,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set Name and Tag Vars
         env:
diff --git a/.github/workflows/test-backstop.yml b/.github/workflows/test-backstop.yml
index 3345ce5e7..af4d16c60 100644
--- a/.github/workflows/test-backstop.yml
+++ b/.github/workflows/test-backstop.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   checks: write
   contents: write
   pull-requests: write
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 772be000b..57c88e88c 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: write
   checks: write
   contents: write
   pull-requests: write