diff --git a/.github/workflows/blog-3day-report.yml b/.github/workflows/blog-3day-report.yml
index 9308e32c84..5569267a36 100644
--- a/.github/workflows/blog-3day-report.yml
+++ b/.github/workflows/blog-3day-report.yml
@@ -40,7 +40,7 @@ concurrency:
 jobs:
   report:
     name: Daily 3-day traffic digest
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
diff --git a/.github/workflows/blog-indexing-monitor.yml b/.github/workflows/blog-indexing-monitor.yml
index 43bf3a4e8b..cd15190911 100644
--- a/.github/workflows/blog-indexing-monitor.yml
+++ b/.github/workflows/blog-indexing-monitor.yml
@@ -38,7 +38,7 @@ concurrency:
 jobs:
   monitor:
     name: Monitor recent blog URLs
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
diff --git a/.github/workflows/blog-indexing-on-deploy.yml b/.github/workflows/blog-indexing-on-deploy.yml
index 215c2af3c8..70a3e626df 100644
--- a/.github/workflows/blog-indexing-on-deploy.yml
+++ b/.github/workflows/blog-indexing-on-deploy.yml
@@ -39,6 +39,8 @@ jobs:
   index:
     name: Index newly deployed blog posts
     if: >-
+      (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name))
+      &&
       github.repository == 'nexu-io/open-design'
       && (
         github.event_name == 'workflow_dispatch'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3d24a7edf6..ce45a8d091 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,7 @@ concurrency:
 
 jobs:
   change_scopes:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: Detect CI change scopes
     runs-on: ubuntu-latest
     outputs:
diff --git a/.github/workflows/contributor-card-bot.yml b/.github/workflows/contributor-card-bot.yml
index a582f9fc68..482348fd44 100644
--- a/.github/workflows/contributor-card-bot.yml
+++ b/.github/workflows/contributor-card-bot.yml
@@ -12,6 +12,10 @@ name: Contributor Card Bot
 # want to recognize. They can be re-added later via a workflow_run handoff.
 on:
   pull_request_target:
+    branches:
+      - development
+      - test
+      - main
     types: [closed]
   issues:
     types: [opened]
@@ -40,6 +44,7 @@ jobs:
   recognize:
     name: Render and post contributor card
     if: |
+      (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) &&
       github.repository == 'nexu-io/open-design' &&
       (
         (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true) ||
diff --git a/.github/workflows/critique-conformance.yml b/.github/workflows/critique-conformance.yml
index aa2ea280d3..24a9092ffa 100644
--- a/.github/workflows/critique-conformance.yml
+++ b/.github/workflows/critique-conformance.yml
@@ -24,6 +24,7 @@ on:
 
 jobs:
   run:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: nightly conformance + ratchet snapshot
     runs-on: ubuntu-latest
     timeout-minutes: 30
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 46d3f6206b..e1ed1f9e0d 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -2,15 +2,14 @@ name: Docker image
 
 # Phase 5 / spec §15.5 — multi-arch image builds.
 #
-# Pushes to ghcr.io on:
-#   - tag (v*.*.*)    → ghcr.io/<owner>/od:<tag> + :latest
+# Pushes to ghcr.io when run manually for a selected ref.
 
 on:
-  push:
-    tags: ['v*.*.*']
+  workflow_dispatch:
 
 jobs:
   build-and-push:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/landing-page-ci.yml b/.github/workflows/landing-page-ci.yml
index efaeac0cb6..9f8c9ea1ea 100644
--- a/.github/workflows/landing-page-ci.yml
+++ b/.github/workflows/landing-page-ci.yml
@@ -2,6 +2,10 @@ name: landing-page-ci
 
 on:
   pull_request:
+    branches:
+      - development
+      - test
+      - main
     paths:
       # Workflow files
       - .github/workflows/landing-page-ci.yml
@@ -48,6 +52,7 @@ concurrency:
 
 jobs:
   validate:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: Validate landing page
     runs-on: ubuntu-latest
     timeout-minutes: 20
diff --git a/.github/workflows/landing-page-deploy.yml b/.github/workflows/landing-page-deploy.yml
index 0700c8d8ef..f46d488b24 100644
--- a/.github/workflows/landing-page-deploy.yml
+++ b/.github/workflows/landing-page-deploy.yml
@@ -35,7 +35,7 @@ concurrency:
 jobs:
   deploy:
     name: Deploy landing page
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
diff --git a/.github/workflows/metrics.yml b/.github/workflows/metrics.yml
index 2cd55dfe0d..b138898667 100644
--- a/.github/workflows/metrics.yml
+++ b/.github/workflows/metrics.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   metrics:
     name: Generate repository metrics SVG
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     steps:
       - name: Generate Open Design bot token
diff --git a/.github/workflows/nix-check.yml b/.github/workflows/nix-check.yml
index 6f3e820d5a..073b62052b 100644
--- a/.github/workflows/nix-check.yml
+++ b/.github/workflows/nix-check.yml
@@ -31,6 +31,7 @@ permissions:
 
 jobs:
   build:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/pr-author-inactivity.yml b/.github/workflows/pr-author-inactivity.yml
index 75be3ccb01..ed58dc2dfe 100644
--- a/.github/workflows/pr-author-inactivity.yml
+++ b/.github/workflows/pr-author-inactivity.yml
@@ -45,7 +45,7 @@ concurrency:
 
 jobs:
   triage:
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     steps:
       - name: Remind or close inactive PRs
diff --git a/.github/workflows/refresh-contributors-wall.yml b/.github/workflows/refresh-contributors-wall.yml
index 661fd2f87e..4070e2d666 100644
--- a/.github/workflows/refresh-contributors-wall.yml
+++ b/.github/workflows/refresh-contributors-wall.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   refresh:
     name: Refresh contributors wall cache bust
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml
index 9303d45838..25d188f6e5 100644
--- a/.github/workflows/release-beta.yml
+++ b/.github/workflows/release-beta.yml
@@ -45,7 +45,7 @@ env:
 jobs:
   metadata:
     name: Prepare beta metadata
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     env:
       OPEN_DESIGN_BETA_METADATA_URL: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}/beta/latest/metadata.json
diff --git a/.github/workflows/release-preview.yml b/.github/workflows/release-preview.yml
index 6f2ec02e4b..1b71b9c74e 100644
--- a/.github/workflows/release-preview.yml
+++ b/.github/workflows/release-preview.yml
@@ -22,6 +22,7 @@ env:
 
 jobs:
   metadata:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: Prepare preview metadata
     runs-on: ubuntu-latest
     env:
diff --git a/.github/workflows/release-stable.yml b/.github/workflows/release-stable.yml
index b4930e0fc0..e33395b3cd 100644
--- a/.github/workflows/release-stable.yml
+++ b/.github/workflows/release-stable.yml
@@ -36,7 +36,7 @@ env:
 jobs:
   metadata:
     name: Prepare release metadata
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     env:
       GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/seo-daily-report.yml b/.github/workflows/seo-daily-report.yml
index b762233e14..924cbe163a 100644
--- a/.github/workflows/seo-daily-report.yml
+++ b/.github/workflows/seo-daily-report.yml
@@ -28,7 +28,7 @@ concurrency:
 jobs:
   report:
     name: Post SEO daily report to Feishu
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml
index 75b3fef028..b8979b6b3a 100644
--- a/.github/workflows/stale-issues.yml
+++ b/.github/workflows/stale-issues.yml
@@ -30,7 +30,7 @@ concurrency:
 
 jobs:
   stale:
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     steps:
       - name: Exempt org-member issues from staling