diff --git a/.github/workflows/envoy-checks.yml b/.github/workflows/envoy-checks.yml
index 1b249ebc595a..9072004f60c1 100644
--- a/.github/workflows/envoy-checks.yml
+++ b/.github/workflows/envoy-checks.yml
@@ -30,7 +30,9 @@ jobs:
       contents: read
       packages: read
       pull-requests: read
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success'
+       && (github.repository == 'envoyproxy/envoy' || vars.ENVOY_CI) }}
     uses: ./.github/workflows/_load.yml
     with:
       check-name: checks
diff --git a/.github/workflows/envoy-publish.yml b/.github/workflows/envoy-publish.yml
index 844da712ae55..12c117f8450d 100644
--- a/.github/workflows/envoy-publish.yml
+++ b/.github/workflows/envoy-publish.yml
@@ -14,13 +14,12 @@ on:
     - completed
 
 concurrency:
-  group: >-
-    ${{ github.actor != 'trigger-release-envoy[bot]'
-        && github.event.inputs.head_ref
-        || github.run_id
-    }}-${{ github.event.workflow.id }}
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
   cancel-in-progress: true
 
+env:
+  CI_DEBUG: ${{ vars.CI_DEBUG }}
+
 
 jobs:
   load:
@@ -35,12 +34,8 @@ jobs:
       packages: read
       pull-requests: read
     if: >-
-      ${{ (github.repository == 'envoyproxy/envoy'
-           || vars.ENVOY_CI)
-          && (!contains(github.actor, '[bot]')
-              || github.actor == 'trigger-workflow-envoy[bot]'
-              || github.actor == 'trigger-release-envoy[bot]')
-      }}
+      ${{ github.event.workflow_run.conclusion == 'success'
+       && (github.repository == 'envoyproxy/envoy' || vars.ENVOY_CI) }}
     uses: ./.github/workflows/_load.yml
     with:
       check-name: publish