diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index 79b796bc49..254d8fc690 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -1,9 +1,15 @@
 # This workflow runs every weekday at 16:00 UTC (9AM PDT)
 name: Daily CI
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   schedule:
     - cron: "00 16 * * 1-5"
+  pull_request:
+    paths: .github/workflows/daily_ci.yml
 
 jobs:
   getVersion:
@@ -88,7 +94,7 @@ jobs:
         daily-ci-net-test-vectors,
         daily-ci-net-examples,
       ]
-    if: ${{ failure() }}
+    if: ${{ failure() && github.event_name == 'schedule' }}
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
       message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 3f237ee0d0..aa95a53011 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -1,6 +1,10 @@
 # This workflow runs for every pull request
 name: PR CI
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   pull_request:
 
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 9e49cf1338..ababdeb051 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -6,6 +6,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   getVersion:
     uses: ./.github/workflows/dafny_version.yml