diff --git a/.github/workflows/tests-secure.yaml b/.github/workflows/tests-secure.yaml
new file mode 100644
index 0000000..4cf2a56
--- /dev/null
+++ b/.github/workflows/tests-secure.yaml
@@ -0,0 +1,45 @@
+name: tests
+
+on:
+  pull_request_target:
+    branches: [ '*' ]
+  push:
+    branches:
+      - "main"
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: ./go.mod
+          cache: false
+      - env:
+          LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
+        run: |
+          export LINODE_TOKEN=${LINODE_TOKEN:?Token not set or empty}
+          make \
+            test-integration
+
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: ./go.mod
+          cache: false
+      - env:
+          LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
+        run: |
+          export LINODE_TOKEN=${LINODE_TOKEN:?Token not set or empty}
+          make \
+            IMG=localhost:5005/linode-cosi-driver \
+            TAG=e2e \
+            cluster \
+            docker-build docker-push \
+            deploy-deps deploy
+      - run: |
+          make test-e2e
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 63c50eb..b8081d4 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -19,35 +19,3 @@ jobs:
       - run: |
           make \
             test
-
-  integration:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: ./go.mod
-          cache: false
-      - run: |
-          export LINODE_TOKEN=${{ secrets.LINODE_TOKEN }}
-          make \
-            test-integration
-
-  e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: ./go.mod
-          cache: false
-      - run: |
-          export LINODE_TOKEN=${{ secrets.LINODE_TOKEN }}
-          make \
-            IMG=localhost:5005/linode-cosi-driver \
-            TAG=e2e-${{ github.ref_name }} \
-            cluster \
-            docker-build docker-push \
-            deploy-deps deploy
-      - run: |
-          make test-e2e