diff --git a/.github/workflows/AssignPrs.yml b/.github/workflows/AssignPrs.yml
index d398cd7cff..a01c0bb095 100644
--- a/.github/workflows/AssignPrs.yml
+++ b/.github/workflows/AssignPrs.yml
@@ -7,6 +7,7 @@ permissions:
 
 jobs:
   run:
+    if: github.repository_owner == 'PowerShell'
     runs-on: ubuntu-latest
     permissions:
       issues: write
diff --git a/.github/workflows/createReminders.yml b/.github/workflows/createReminders.yml
index ef2c5fa1cc..0333b635d5 100644
--- a/.github/workflows/createReminders.yml
+++ b/.github/workflows/createReminders.yml
@@ -9,6 +9,8 @@ permissions:
 
 jobs:
   reminder:
+    if: github.repository_owner == 'PowerShell'
+
     permissions:
       issues: write  # for agrc/create-reminder-action to set reminders on issues
       pull-requests: write  # for agrc/create-reminder-action to set reminders on PRs
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 794ef64b21..fdb0ae4cd7 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   verify-labels:
-    if: github.repository_owner == 'PowerShell'
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index 68b651c7e4..d7d7631084 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -37,6 +37,7 @@ env:
   system_debug: 'false'
 jobs:
   changes:
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     name: Change Detection
     runs-on: ubuntu-latest
     # Required permissions
@@ -50,7 +51,7 @@ jobs:
         uses: actions/checkout@v4.1.0
 
         # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.2.0
         id: filter
         with:
           list-files: json
@@ -232,7 +233,7 @@ jobs:
       - linux_test_unelevated_others
       - analyze
     if: always()
-    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
     with:
       needs_context: ${{ toJson(needs) }}
   # TODO: Enable this when we have a Linux packaging workflow
diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index b414afebfc..d7d5dc76d0 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -38,6 +38,7 @@ jobs:
   changes:
     name: Change Detection
     runs-on: ubuntu-latest
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     # Required permissions
     permissions:
       pull-requests: read
@@ -49,7 +50,7 @@ jobs:
         uses: actions/checkout@v4.1.0
 
         # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.2.0
         id: filter
         with:
           list-files: json
@@ -186,6 +187,6 @@ jobs:
       - macos_test_unelevated_ci
       - macos_test_unelevated_others
     if: always()
-    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
     with:
       needs_context: ${{ toJson(needs) }}
diff --git a/.github/workflows/markdownLink.yml b/.github/workflows/markdownLink.yml
index 950534f1e5..85b9f51a74 100644
--- a/.github/workflows/markdownLink.yml
+++ b/.github/workflows/markdownLink.yml
@@ -11,6 +11,8 @@ permissions:
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'PowerShell'
+
     steps:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
diff --git a/.github/workflows/processReminders.yml b/.github/workflows/processReminders.yml
index c6ac936343..a2d5b4dbd9 100644
--- a/.github/workflows/processReminders.yml
+++ b/.github/workflows/processReminders.yml
@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   reminder:
+    if: github.repository_owner == 'PowerShell'
     permissions:
       issues: write  # for agrc/reminder-action to set reminders on issues
       pull-requests: write  # for agrc/reminder-action to set reminders on PRs
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 21430546a1..90ac8e0b76 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -20,6 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
+    if: github.repository_owner == 'PowerShell'
     runs-on: ubuntu-latest
     permissions:
       # Needed to upload the results to code-scanning dashboard.
diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml
index c93983a765..9f2aef06a5 100644
--- a/.github/workflows/windows-ci.yml
+++ b/.github/workflows/windows-ci.yml
@@ -39,6 +39,7 @@ jobs:
   changes:
     name: Change Detection
     runs-on: ubuntu-latest
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     # Required permissions
     permissions:
       pull-requests: read
@@ -50,7 +51,7 @@ jobs:
         uses: actions/checkout@v4.1.0
 
         # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.2.0
         id: filter
         with:
           list-files: json
@@ -170,6 +171,6 @@ jobs:
       - windows_test_unelevated_ci
       - windows_test_unelevated_others
     if: always()
-    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
     with:
       needs_context: ${{ toJson(needs) }}