diff --git a/.github/workflows/ci-suite.yml b/.github/workflows/ci-suite.yml
index c68d96617e..ab628812d8 100644
--- a/.github/workflows/ci-suite.yml
+++ b/.github/workflows/ci-suite.yml
@@ -5,6 +5,10 @@ on:
     branches:
     - dev
     - master
+  pull_request:
+    branches:
+    - dev
+    - master
   pull_request_target:
     types: [opened, reopened, labeled, synchronize]
     branches:
@@ -29,26 +33,33 @@ jobs:
     name: Check CI Clearance
     needs: security-checkpoint
     runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request_target' && github.pull_request.head.repo.id != github.repository.id
     steps:
     - name: Comment on new Fork PR
-      if: github.event_name != 'push' && github.pull_request.head.repo.id != github.repository.id && github.event.action == 'opened'
+      if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')
       uses: thollander/actions-comment-pull-request@v2
       with:
         message: Thank you for contributing to tgstation-server! As this pull request is from a fork, we can't allow the CI actions which require repository secrets to run on it without approval. After a brief review to make sure you're not misusing those secrets, a maintainer will add the `CI Cleared` label to allow the CI suite to run. Maintainers, please note that any changes to workflow files will not be reflected in the CI run.
 
     - name: "Remove Stale 'CI Cleared' Label"
-      if: github.event_name != 'push' && github.pull_request.head.repo.id != github.repository.id && (github.event.action == 'synchronize' || github.event.action == 'reopened')
+      if: github.event.action == 'synchronize' || github.event.action == 'reopened'
       uses: actions-ecosystem/action-remove-labels@v1
       with:
         labels: CI Cleared
 
     - name: Fail Clearance Check if PR has Unlabeled new Commits from Fork
-      if: github.event_name != 'push' && github.pull_request.head.repo.id != github.repository.id && (github.event.action != 'labeled' || !contains(github.event.pull_request.labels.*.name, 'CI Cleared'))
+      if: (github.event.action == 'synchronize' || github.event.action == 'reopened') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')
       run: exit 1
 
+  start-ci-run-gate:
+    name: Start CI Run Gate
+    needs: security-checkpoint
+    runs-on: ubuntu-latest
+    if: always() && (needs.security-check.result == 'success' || needs.security-check.result == 'skipped')
+
   analyze:
     name: Code Scanning
-    needs: security-checkpoint
+    needs: start-ci-run-gate
     runs-on: ubuntu-latest
     steps:
     - name: Install Node 12.X
@@ -85,6 +96,7 @@ jobs:
 
   dmapi-build:
     name: Build DMAPI
+    needs: start-ci-run-gate
     env:
       BYOND_MAJOR: 515
       BYOND_MINOR: 1592
@@ -141,6 +153,7 @@ jobs:
   dox-build:
     name: Build Doxygen Site
     runs-on: ubuntu-latest
+    needs: start-ci-run-gate
     steps:
     - name: Checkout (Branch Push)
       uses: actions/checkout@v3
@@ -189,6 +202,7 @@ jobs:
   docker-build:
     name: Build Docker Image
     runs-on: ubuntu-latest
+    needs: start-ci-run-gate
     steps:
     - name: Checkout (Branch Push)
       uses: actions/checkout@v3
@@ -205,7 +219,7 @@ jobs:
 
   linux-unit-tests:
     name: Linux Tests
-    needs: security-checkpoint
+    needs: start-ci-run-gate
     strategy:
       fail-fast: false
       matrix:
@@ -244,7 +258,7 @@ jobs:
 
   windows-unit-tests:
     name: Windows Tests
-    needs: security-checkpoint
+    needs: start-ci-run-gate
     strategy:
       fail-fast: false
       matrix:
@@ -283,7 +297,7 @@ jobs:
 
   windows-integration-test:
     name: Windows Live Tests
-    needs: [security-checkpoint, dmapi-build]
+    needs: dmapi-build
     env:
       TGS_TEST_DATABASE_TYPE: SqlServer
       TGS_TEST_DUMP_API_SPEC: yes
@@ -362,7 +376,7 @@ jobs:
 
   linux-integration-tests:
     name: Linux Live Tests
-    needs: [security-checkpoint, dmapi-build]
+    needs: dmapi-build
     services: # We start all dbs here so we can just code the stuff once
       postgres:
         image: cyberboss/postgres-max-connections # Fork of _/postgres:latest with max_connections=500 becuase GitHub actions service containers have no way to set command lines. Rebuilds with updates.