diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
index c0aa61445..34873f3c5 100644
--- a/.github/workflows/analysis.yml
+++ b/.github/workflows/analysis.yml
@@ -5,8 +5,8 @@ on:
       - "master"
     tags-ignore:
       - "**"
-  pull_request_target:
-    types: [labeled]
+  pull_request:
+    types: [opened, synchronize, reopened]
     branches:
       - "master"
 permissions:
diff --git a/.github/workflows/build-gate.yml b/.github/workflows/build-gate.yml
new file mode 100644
index 000000000..24f0bf5af
--- /dev/null
+++ b/.github/workflows/build-gate.yml
@@ -0,0 +1,46 @@
+name: Build Gate
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: [master]
+  push:
+    branches: [master]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'pull_request_target' && 'build-gate' || '' }}
+    steps:
+      - run: echo "Approved — releasing frogbot and test suite."
+
+  frogbot:
+    needs: gate
+    uses: ./.github/workflows/frogbot-scan-pull-request.yml
+    secrets: inherit
+
+  tests:
+    needs: gate
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+
+  # Single, stable required status check. Point branch protection at
+  # "Build Gate / build-gate-success" instead of the matrix-expanded suite checks.
+  build-gate-success:
+    name: build-gate-success
+    if: always()
+    needs:
+      - gate
+      - frogbot
+      - tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify no suite failed or was cancelled
+        run: |
+          if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then
+            echo "::error::One or more suites failed or were cancelled."
+            exit 1
+          fi
+          echo "All suites succeeded (skipped suites are allowed)."
diff --git a/.github/workflows/frogbot-scan-pull-request.yml b/.github/workflows/frogbot-scan-pull-request.yml
index c9eb75800..c207cd6bf 100644
--- a/.github/workflows/frogbot-scan-pull-request.yml
+++ b/.github/workflows/frogbot-scan-pull-request.yml
@@ -1,9 +1,6 @@
 name: "Frogbot Scan Pull Request"
 on:
-  pull_request_target:
-    types: [opened, synchronize]
-    branches:
-      - master
+  workflow_call:
 permissions:
   pull-requests: write
   contents: read
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 128458af6..185ad401c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,15 +1,7 @@
 name: JFrog CLI Core Tests
 on:
+  workflow_call:
   workflow_dispatch:
-  push:
-    branches:
-      - master
-    tags-ignore:
-      - "**"
-  pull_request_target:
-    branches:
-      - master
-    types: [labeled]
 jobs:
   test:
     runs-on: ${{ matrix.os }}-latest