diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index bb827b271..d5712ebe3 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -287,6 +287,18 @@ jobs:
     - name: Workflow is not a success
       if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
       run: exit 1
+    - uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76
+      with: 
+        authToken: ${{secrets.GITHUB_TOKEN}}
+        # Write an explicit status check called "Sentinel" which will only pass if this code really runs.
+        # Once rolled out, we can make this the only required check for PRs,
+        # then remove the old conditionals on this job and remove the previous step.
+        context: 'Sentinel'
+        description: 'All required checks passed'
+        state: 'success'
+        # Write to the PR commit SHA if it's available as we don't want the merge commit sha,
+        # otherwise use the current SHA for any other type of build.
+        sha: ${{ github.event.pull_request.head.sha || github.sha }}
     - name: Workflow is a success
       run: echo "🎉🎈🎉🎈🎉"
 
diff --git a/scripts/upstream.sh b/scripts/upstream.sh
index 7d35e3b67..d35932e0e 100755
--- a/scripts/upstream.sh
+++ b/scripts/upstream.sh
@@ -79,17 +79,13 @@ start_rebase() {
   rm -rf .git/modules/upstream/rebase-merge
   cd upstream && git fetch
 
-  if [ -z "$TO" ]; then
-     echo "\$TO not set, assuming TO is the upstream SHA currently committed."
-  else
-     git checkout "$TO"
-  fi
-
   git branch -f local
   if [ -n "$FROM" ]; then
-     git checkout -B pulumi-patch "$FROM"
+      echo "Rebasing from $FROM to $(git rev-parse HEAD)"
+      git checkout -B pulumi-patch "$FROM"
   else
-     git checkout -B pulumi-patch
+      echo "Rebasing in place at $(git rev-parse HEAD)"
+      git checkout -B pulumi-patch
   fi
   git branch --set-upstream-to=local pulumi-patch
 
@@ -120,7 +116,7 @@ assert_rebase_in_progress() {
 Didn't detect an upstream rebase in progress.
 To start an upstream rebase, run
 
-    [FROM=vX.Y.Z] [TO=vA.B.C] make upstream.rebase
+    [FROM=vX.Y.Z] make upstream.rebase
 
 If you are absolutly sure you are already in a rebase, run
 
@@ -149,7 +145,7 @@ make "$1"' failed to apply ${patch}. This is because there is a conflict between
 the checked out version of upstream and the patch set. To resolve this conflict
 run:
 
-    FROM=\$LAST_KNOWN_GOOD_COMMIT TO=\$NEW_COMMIT make upstream.rebase
+    FROM=\$LAST_KNOWN_GOOD_COMMIT make upstream.rebase
 
 This will walk you through resolving the conflict and producing a patch set that
 cleanly applies to the current upstream.