diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 0096eb076b..81f0c86cc8 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -7,13 +7,6 @@ on:
       - release/v*
 
 jobs:
-  check-no-ee-references:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Run check
-        run: make check-no-ee-references
-
   build-frontend:
     runs-on: ubuntu-latest
     steps:
@@ -21,9 +14,6 @@ jobs:
         uses: actions/checkout@v4
       - name: Install dependencies
         run: cd frontend && yarn install
-      - name: TSC
-        run: yarn i18n:generate-hash && yarn tsc
-        working-directory: ./frontend
       - name: Build frontend docker image
         shell: bash
         run: |
diff --git a/.github/workflows/commitci.yaml b/.github/workflows/commitci.yaml
new file mode 100644
index 0000000000..5b02f75dc5
--- /dev/null
+++ b/.github/workflows/commitci.yaml
@@ -0,0 +1,39 @@
+name: commitci
+
+on:
+  pull_request:
+    branches:
+      - main
+  pull_request_target:
+    types:
+      - labeled
+
+jobs:
+  refcheck:
+    if: |
+      (github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login != 'dependabot[bot]' && ! contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
+      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe-to-test'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: check
+        run: |
+          if grep -R --include="*.go" '.*/ee/.*' pkg/; then
+            echo "Error: Found references to 'ee' packages in 'pkg' directory"
+            exit 1
+          else
+            echo "No references to 'ee' packages found in 'pkg' directory"
+          fi
+  lint:
+    if: |
+      (github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login != 'dependabot[bot]' && ! contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
+      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe-to-test'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: lint
+        uses: wagoid/commitlint-github-action@v5
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
deleted file mode 100644
index 3a38338cf0..0000000000
--- a/.github/workflows/commitlint.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: commitlint
-on: [pull_request]
-defaults:
-  run:
-    working-directory: frontend
-jobs:
-  lint-commits:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v5
diff --git a/.github/workflows/jsci.yaml b/.github/workflows/jsci.yaml
index 041a041a5c..1362f5d5e9 100644
--- a/.github/workflows/jsci.yaml
+++ b/.github/workflows/jsci.yaml
@@ -9,6 +9,18 @@ on:
       - labeled
 
 jobs:
+  tsc:
+    if: |
+      (github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login != 'dependabot[bot]' && ! contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
+      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe-to-test'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: install
+        run: cd frontend && yarn install
+      - name: tsc
+        run: cd frontend && yarn tsc
   test:
     if: |
       (github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login != 'dependabot[bot]' && ! contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
diff --git a/.github/workflows/remove-label.yaml b/.github/workflows/remove-label.yaml
index ef570a6ac1..7cea362a5c 100644
--- a/.github/workflows/remove-label.yaml
+++ b/.github/workflows/remove-label.yaml
@@ -8,12 +8,6 @@ jobs:
   remove:
     runs-on: ubuntu-latest
     steps:
-      - name: Remove label ok-to-test from PR
-        uses: buildsville/add-remove-label@v2.0.0
-        with:
-          label: ok-to-test
-          type: remove
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Remove label testing-deploy from PR
         uses: buildsville/add-remove-label@v2.0.0
         with: