diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ed6cb77..6ad1a579 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,24 @@
 name: Docker build and push
 
 on:
+  # pull_request so the lint/codegen/test gate runs on fork PRs too: a fork's commits never push to
+  # this repo, so a push-only trigger let a fork edit the schema without regenerating types.ts (or
+  # ship a lint/test failure) and merge green, since e2e.yml's tsc build cannot see stale codegen.
+  # lint-and-test uses no secrets and is fork-safe; docker-build stays gated to main/tags below.
+  pull_request:
+    types: [opened, synchronize, reopened]
   push:
     branches:
-      - "**"
+      - main
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
 
+# A PR's synchronize pushes supersede each other; keep only the latest run per ref.
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -32,7 +43,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version: "1.24"
           cache: true
           cache-dependency-path: backend/go.sum
 
@@ -47,8 +58,8 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: frontend/.nvmrc
-          cache: 'pnpm'
-          cache-dependency-path: 'frontend/pnpm-lock.yaml'
+          cache: "pnpm"
+          cache-dependency-path: "frontend/pnpm-lock.yaml"
 
       # Frontend lint and test
       - name: Frontend - Install dependencies
@@ -135,17 +146,17 @@ jobs:
           PACKAGE_VER=${LATEST_TAG#v}
           CURRENT_COMMIT=$(git rev-parse HEAD)
           TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG" 2>/dev/null || echo "")
-          
+
           if [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
             PACKAGE_REV=$(git rev-parse --short HEAD)
           else
             PACKAGE_REV=""
           fi
-          
+
           LDFLAGS="-X pentagi/pkg/version.PackageName=pentagi -X pentagi/pkg/version.PackageVer=${PACKAGE_VER} -X pentagi/pkg/version.PackageRev=${PACKAGE_REV}"
-          
+
           echo "Building with version: ${PACKAGE_VER}${PACKAGE_REV:+-$PACKAGE_REV}"
-          
+
           # Build for AMD64
           GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "$LDFLAGS" -o /tmp/pentagi-amd64 ./cmd/pentagi
           echo "✓ Successfully built for linux/amd64"
@@ -181,13 +192,13 @@ jobs:
           # Get latest tag version (without 'v' prefix)
           LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
           VERSION=${LATEST_TAG#v}
-          
+
           # Get current commit hash
           CURRENT_COMMIT=$(git rev-parse HEAD)
-          
+
           # Get commit hash of the latest tag
           TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG" 2>/dev/null || echo "")
-          
+
           # Set revision only if current commit differs from tag commit
           if [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
             PACKAGE_REV=$(git rev-parse --short HEAD)
@@ -207,7 +218,7 @@ jobs:
             echo "patch=${VERSION}" >> $GITHUB_OUTPUT
             echo "  Docker tags: latest, ${major}, ${major}.${minor}, ${VERSION}"
           fi
-          
+
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Generate Docker metadata