diff --git a/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml b/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml
index 0b0cdfa5018..4cb146d4029 100644
--- a/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml
+++ b/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml
@@ -7,15 +7,15 @@ name: Deploy Nodes to GCP
 on:
   pull_request:
 
-# IMPORTANT
-#
-# The job names in `cd-deploy-nodes-gcp.yml`, `cd-deploy-nodes-gcp.patch.yml` and
-# `cd-deploy-nodes-gcp.patch-external.yml` must be kept in sync.
+#! IMPORTANT
+#!
+#! The job names in `cd-deploy-nodes-gcp.yml`, `cd-deploy-nodes-gcp.patch.yml` and
+#! `cd-deploy-nodes-gcp.patch-external.yml` must be kept in sync.
 jobs:
   # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
   get-disk-name:
-    name: Get disk name
-    if: ${{ startsWith(github.event_name, 'pull') && github.event.pull_request.head.repo.fork }}
+    name: Get disk name / Get Mainnet cached disk
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "Skipping job on fork"'
@@ -24,6 +24,7 @@ jobs:
     name: Build CD Docker / Build images
     # Only run on PRs from external repositories, skipping ZF branches and tags.
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
@@ -33,13 +34,15 @@ jobs:
     # change.
     needs: build
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-configuration-file-testnet:
-    name: Test CD testnet Docker config file / Test default-conf in Docker
+    name: Test CD testnet Docker config file / Test testnet-conf in Docker
     needs: build
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
@@ -47,6 +50,6 @@ jobs:
     name: Test CD custom Docker config file / Test custom-conf in Docker
     needs: build
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
-
diff --git a/.github/workflows/cd-deploy-nodes-gcp.patch.yml b/.github/workflows/cd-deploy-nodes-gcp.patch.yml
index 6f88cf2cfe2..b5ea40a0e2e 100644
--- a/.github/workflows/cd-deploy-nodes-gcp.patch.yml
+++ b/.github/workflows/cd-deploy-nodes-gcp.patch.yml
@@ -22,39 +22,43 @@ on:
      - '.github/workflows/cd-deploy-nodes-gcp.yml'
      - '.github/workflows/sub-build-docker-image.yml'
 
-# IMPORTANT
-#
-# The job names in `cd-deploy-nodes-gcp.yml`, `cd-deploy-nodes-gcp.patch.yml` and
-# `cd-deploy-nodes-gcp.patch-external.yml` must be kept in sync.
+#! IMPORTANT
+#!
+#! The job names in `cd-deploy-nodes-gcp.yml`, `cd-deploy-nodes-gcp.patch.yml` and
+#! `cd-deploy-nodes-gcp.patch-external.yml` must be kept in sync.
 jobs:
   # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
+  get-disk-name:
+    name: Get disk name / Get Mainnet cached disk
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
+    steps:
+      - run: 'echo "No build required"'
+
   build:
     name: Build CD Docker / Build images
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-configuration-file:
     name: Test CD default Docker config file / Test default-conf in Docker
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-configuration-file-testnet:
-    name: Test CD testnet Docker config file / Test default-conf in Docker
+    name: Test CD testnet Docker config file / Test testnet-conf in Docker
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
-
   test-zebra-conf-path:
     name: Test CD custom Docker config file / Test custom-conf in Docker
     runs-on: ubuntu-latest
-    steps:
-      - run: 'echo "No build required"'
-
-  get-disk-name:
-    name: Get disk name
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
diff --git a/.github/workflows/ci-coverage.yml b/.github/workflows/ci-coverage.yml
index 4a97563143b..d2dfdd9ff1a 100644
--- a/.github/workflows/ci-coverage.yml
+++ b/.github/workflows/ci-coverage.yml
@@ -103,4 +103,4 @@ jobs:
         run: cargo llvm-cov --lcov --no-run --output-path lcov.info
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v5.1.1
+        uses: codecov/codecov-action@v5.1.2
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
index 26ec61089b3..0e40daa7c7e 100644
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Rust files
         id: changed-files-rust
-        uses: tj-actions/changed-files@v45.0.5
+        uses: tj-actions/changed-files@v45.0.6
         with:
           files: |
             **/*.rs
@@ -56,7 +56,7 @@ jobs:
 
       - name: Workflow files
         id: changed-files-workflows
-        uses: tj-actions/changed-files@v45.0.5
+        uses: tj-actions/changed-files@v45.0.6
         with:
           files: |
             .github/workflows/*.yml
@@ -93,7 +93,7 @@ jobs:
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=stable --profile=default
 
-      - uses: Swatinem/rust-cache@v2.7.5
+      - uses: Swatinem/rust-cache@v2.7.7
         with:
           shared-key: "clippy-cargo-lock"
 
@@ -138,7 +138,7 @@ jobs:
 
       # We don't cache `fmt` outputs because the job is quick,
       # and we want to use the limited GitHub actions cache space for slower jobs.
-      #- uses: Swatinem/rust-cache@v2.7.5
+      #- uses: Swatinem/rust-cache@v2.7.7
 
       - run: |
           cargo fmt --all -- --check
diff --git a/.github/workflows/ci-tests.patch-external.yml b/.github/workflows/ci-tests.patch-external.yml
index 8fef3e75889..f257315788b 100644
--- a/.github/workflows/ci-tests.patch-external.yml
+++ b/.github/workflows/ci-tests.patch-external.yml
@@ -15,7 +15,7 @@ jobs:
   build:
     name: Build CI Docker / Build images
     # Only run on PRs from external repositories.
-    if: ${{ startsWith(github.event_name, 'pull') && github.event.pull_request.head.repo.fork }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "Skipping job on fork"'
@@ -24,116 +24,134 @@ jobs:
   ## The following jobs are related to sub-ci-unit-tests-docker.yml
   ###
   test-all:
-    name: Test all
+    name: Unit tests / Test all
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-fake-activation-heights:
-    name: Test with fake activation heights
+    name: Unit tests / Test with fake activation heights
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-empty-sync:
-    name: Test checkpoint sync from empty state
+    name: Unit tests / Test checkpoint sync from empty state
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-lightwalletd-integration:
-    name: Test integration with lightwalletd
+    name: Unit tests / Test integration with lightwalletd
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-configuration-file:
-    name: Test CI default Docker config file / Test default-conf in Docker
+    name: Unit tests / Test CI default Docker config file / Test default-conf in Docker
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-configuration-file-testnet:
-    name: Test CI testnet Docker config file / Test default-conf in Docker
+    name: Unit tests / Test CI testnet Docker config file / Test testnet-conf in Docker
     needs: build
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-zebra-conf-path:
-    name: Test CI custom Docker config file / Test custom-conf in Docker
+    name: Unit tests / Test CI custom Docker config file / Test custom-conf in Docker
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
-
+  ####
   ####
   ## The following jobs are related to sub-ci-integration-tests-gcp.yml
   ###
 
   # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
   get-available-disks:
-    name: Check if cached state disks exist for Mainnet / Check if cached state disks exist
+    name: Integration tests / Check if cached state disks exist for Mainnet / Get Mainnet cached disk
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-stateful-sync:
-    name: Zebra checkpoint update / Run sync-past-checkpoint test
+    name: Integration tests / Zebra checkpoint update / Run sync-past-checkpoint test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   test-update-sync:
-    name: Zebra tip update / Run update-to-tip test
+    name: Integration tests / Zebra tip update / Run update-to-tip test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   checkpoints-mainnet:
-    name: Generate checkpoints mainnet / Run checkpoints-mainnet test
+    name: Integration tests / Generate checkpoints mainnet / Run checkpoints-mainnet test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   lightwalletd-rpc-test:
-    name: Zebra tip JSON-RPC / Run fully-synced-rpc test
+    name: Integration tests / Zebra tip JSON-RPC / Run fully-synced-rpc test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   lightwalletd-transactions-test:
-    name: lightwalletd tip send / Run lwd-send-transactions test
+    name: Integration tests / lightwalletd tip send / Run lwd-send-transactions test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   get-block-template-test:
-    name: get block template / Run get-block-template test
+    name: Integration tests / get block template / Run get-block-template test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   submit-block-test:
-    name: submit block / Run submit-block test
+    name: Integration tests / submit block / Run submit-block test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   lightwalletd-full-sync:
-    name: lightwalletd tip / Run lwd-full-sync test
+    name: Integration tests / lightwalletd tip / Run lwd-full-sync test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   lightwalletd-update-sync:
-    name: lightwalletd tip update / Run lwd-update-sync test
+    name: Integration tests / lightwalletd tip update / Run lwd-update-sync test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
   lightwalletd-grpc-test:
-    name: lightwalletd GRPC tests / Run lwd-grpc-wallet test
+    name: Integration tests / lightwalletd GRPC tests / Run lwd-grpc-wallet test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
diff --git a/.github/workflows/ci-tests.patch.yml b/.github/workflows/ci-tests.patch.yml
index 5320b149bbb..e0a7ff605fd 100644
--- a/.github/workflows/ci-tests.patch.yml
+++ b/.github/workflows/ci-tests.patch.yml
@@ -43,45 +43,52 @@ jobs:
   ## The following jobs are related to sub-ci-unit-tests-docker.yml
   ###
   test-all:
-    name: Test all
+    name: Unit tests / Test all
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-fake-activation-heights:
-    name: Test with fake activation heights
+    name: Unit tests / Test with fake activation heights
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-empty-sync:
-    name: Test checkpoint sync from empty state
+    name: Unit tests / Test checkpoint sync from empty state
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-lightwalletd-integration:
-    name: Test integration with lightwalletd
+    name: Unit tests / Test integration with lightwalletd
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-configuration-file:
-    name: Test CI default Docker config file / Test default-conf in Docker
+    name: Unit tests / Test CI default Docker config file / Test default-conf in Docker
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
-  test-configuration-file-testnet:
-    name: Test CI testnet Docker config file / Test default-conf in Docker
+  test-configuration-file-testnet:  
+    name: Unit tests / Test CI testnet Docker config file / Test testnet-conf in Docker
     needs: build
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-zebra-conf-path:
-    name: Test CI custom Docker config file / Test custom-conf in Docker
+    name: Unit tests / Test CI custom Docker config file / Test custom-conf in Docker
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
@@ -92,67 +99,78 @@ jobs:
 
   # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
   get-available-disks:
-    name: Check if cached state disks exist for Mainnet / Check if cached state disks exist
+    name: Integration tests / Check if cached state disks exist for Mainnet / Get Mainnet cached disk
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-stateful-sync:
-    name: Zebra checkpoint update / Run sync-past-checkpoint test
+    name: Integration tests / Zebra checkpoint update / Run sync-past-checkpoint test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   test-update-sync:
-    name: Zebra tip update / Run update-to-tip test
+    name: Integration tests / Zebra tip update / Run update-to-tip test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   checkpoints-mainnet:
-    name: Generate checkpoints mainnet / Run checkpoints-mainnet test
+    name: Integration tests / Generate checkpoints mainnet / Run checkpoints-mainnet test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   lightwalletd-rpc-test:
-    name: Zebra tip JSON-RPC / Run fully-synced-rpc test
+    name: Integration tests / Zebra tip JSON-RPC / Run fully-synced-rpc test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   lightwalletd-transactions-test:
-    name: lightwalletd tip send / Run lwd-send-transactions test
+    name: Integration tests / lightwalletd tip send / Run lwd-send-transactions test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   get-block-template-test:
-    name: get block template / Run get-block-template test
+    name: Integration tests / get block template / Run get-block-template test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   submit-block-test:
-    name: submit block / Run submit-block test
+    name:  Integration tests / submit block / Run submit-block test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   lightwalletd-full-sync:
-    name: lightwalletd tip / Run lwd-full-sync test
+    name: Integration tests / lightwalletd tip / Run lwd-full-sync test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   lightwalletd-update-sync:
-    name: lightwalletd tip update / Run lwd-update-sync test
+    name: Integration tests / lightwalletd tip update / Run lwd-update-sync test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   lightwalletd-grpc-test:
-    name: lightwalletd GRPC tests / Run lwd-grpc-wallet test
+    name: Integration tests / lightwalletd GRPC tests / Run lwd-grpc-wallet test
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
diff --git a/.github/workflows/ci-unit-tests-os.yml b/.github/workflows/ci-unit-tests-os.yml
index ec1b52fd5d8..6e9dc77d91d 100644
--- a/.github/workflows/ci-unit-tests-os.yml
+++ b/.github/workflows/ci-unit-tests-os.yml
@@ -115,7 +115,7 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=${{ matrix.rust }} --profile=minimal
 
 
-      - uses: Swatinem/rust-cache@v2.7.5
+      - uses: Swatinem/rust-cache@v2.7.7
         # TODO: change Rust cache target directory on Windows,
         #       or remove this workaround once the build is more efficient (#3005).
         #with:
@@ -224,7 +224,7 @@ jobs:
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=stable --profile=minimal
 
-      - uses: Swatinem/rust-cache@v2.7.5
+      - uses: Swatinem/rust-cache@v2.7.7
         with:
           shared-key: "clippy-cargo-lock"
 
@@ -283,7 +283,7 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=stable --profile=minimal
 
       - name: Install cargo-machete
-        uses: baptiste0928/cargo-install@v3.1.1
+        uses: baptiste0928/cargo-install@v3.3.0
         with:
           crate: cargo-machete
 
diff --git a/.github/workflows/docs-deploy-firebase.patch-external.yml b/.github/workflows/docs-deploy-firebase.patch-external.yml
index 3c6d9c16942..9a725ba21b6 100644
--- a/.github/workflows/docs-deploy-firebase.patch-external.yml
+++ b/.github/workflows/docs-deploy-firebase.patch-external.yml
@@ -7,16 +7,15 @@ name: Docs
 on:
   pull_request:
 
-# IMPORTANT
-#
-# The job names in `docs-deploy-firebase.yml`, `docs-deploy-firebase.patch.yml` and
-# `docs-deploy-firebase.patch-external.yml` must be kept in sync.
+#! IMPORTANT
+#!
+#! The job names in `docs-deploy-firebase.yml`, `docs-deploy-firebase.patch.yml` and
+#! `docs-deploy-firebase.patch-external.yml` must be kept in sync.
 jobs:
   build-docs-book:
     name: Build and Deploy Zebra Book Docs
-    # Only run on PRs from external repositories.
-    if: ${{ startsWith(github.event_name, 'pull') && github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
 
@@ -26,5 +25,6 @@ jobs:
     # change.
     needs: build-docs-book
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "Skipping job on fork"'
diff --git a/.github/workflows/docs-deploy-firebase.patch.yml b/.github/workflows/docs-deploy-firebase.patch.yml
index 7d84ff75961..30c0793d852 100644
--- a/.github/workflows/docs-deploy-firebase.patch.yml
+++ b/.github/workflows/docs-deploy-firebase.patch.yml
@@ -21,19 +21,21 @@ on:
       # workflow definitions
       - '.github/workflows/docs-deploy-firebase.yml'
 
-# IMPORTANT
-#
-# The job names in `docs-deploy-firebase.yml`, `docs-deploy-firebase.patch.yml` and
-# `docs-deploy-firebase.patch-external.yml` must be kept in sync.
+#! IMPORTANT
+#!
+#! The job names in `docs-deploy-firebase.yml`, `docs-deploy-firebase.patch.yml` and
+#! `docs-deploy-firebase.patch-external.yml` must be kept in sync.
 jobs:
   build-docs-book:
     name: Build and Deploy Zebra Book Docs
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
 
   build-docs-internal:
     name: Build and Deploy Zebra Internal Docs
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     steps:
       - run: 'echo "No build required"'
diff --git a/.github/workflows/docs-deploy-firebase.yml b/.github/workflows/docs-deploy-firebase.yml
index 38542be45e9..0154ffe1bd7 100644
--- a/.github/workflows/docs-deploy-firebase.yml
+++ b/.github/workflows/docs-deploy-firebase.yml
@@ -155,7 +155,7 @@ jobs:
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=beta --profile=default
 
-      - uses: Swatinem/rust-cache@v2.7.5
+      - uses: Swatinem/rust-cache@v2.7.7
 
       - name: Build internal docs
         run: |
diff --git a/.github/workflows/sub-build-docker-image.yml b/.github/workflows/sub-build-docker-image.yml
index ac6d5bbbecc..31e965976a8 100644
--- a/.github/workflows/sub-build-docker-image.yml
+++ b/.github/workflows/sub-build-docker-image.yml
@@ -161,7 +161,7 @@ jobs:
       # Build and push image to Google Artifact Registry, and possibly DockerHub
       - name: Build & push
         id: docker_build
-        uses: docker/build-push-action@v6.10.0
+        uses: docker/build-push-action@v6.11.0
         with:
           target: ${{ inputs.dockerfile_target }}
           context: .