diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index e2332c3e1d..e666260926 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -8,9 +8,6 @@ on:
       - 'docs/**'
       - '*.lock'
       - 'mkdocs.yml'
-  # Allow maintainers to trigger Claude review for fork PRs via 'ci-approved' label.
-  pull_request_target:
-    types: [labeled, synchronize]
   issue_comment:
     types: [created]
   pull_request_review_comment:
@@ -27,12 +24,10 @@ jobs:
   review:
     name: Claude PR Review
     if: >-
-      github.repository == 'lightseekorg/smg'
+      github.event_name == 'pull_request'
+      && github.repository == 'lightseekorg/smg'
       && github.actor != 'dependabot[bot]'
-      && (
-        (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork)
-        || (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'ci-approved'))
-      )
+      && !github.event.pull_request.head.repo.fork
     runs-on: k8s-runner-cpu
     timeout-minutes: 30
     concurrency:
@@ -42,7 +37,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Export API key from pod env
diff --git a/.github/workflows/pr-test-rust.yml b/.github/workflows/pr-test-rust.yml
index 14bfcd9d90..dbd1fbe721 100644
--- a/.github/workflows/pr-test-rust.yml
+++ b/.github/workflows/pr-test-rust.yml
@@ -14,20 +14,14 @@ on:
       - "docs/**"
       - "mkdocs.yml"
       - "*.md"
-  # Allow maintainers to trigger CI for fork PRs by adding the 'ci-approved' label.
-  # pull_request_target runs in the base branch context, bypassing the fork approval gate.
-  # 'synchronize' re-runs CI on subsequent pushes while the label is present.
-  pull_request_target:
-    branches: [ main ]
-    types: [labeled, synchronize]
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: gateway-tests-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: gateway-tests-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   RUSTC_WRAPPER: sccache
@@ -35,25 +29,12 @@ env:
   GENAI_BENCH_IMAGE: ghcr.io/moirai-internal/genai-bench:0.0.4
 
 jobs:
-  # Gate job: for pull_request_target, only proceed if 'ci-approved' label is present.
-  # All other triggers (push, pull_request, workflow_dispatch) pass through unconditionally.
-  ci-gate:
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request_target' ||
-      contains(github.event.pull_request.labels.*.name, 'ci-approved')
-    steps:
-      - run: echo "CI gate passed"
-
   pre-commit:
-    needs: [ci-gate]
     runs-on: k8s-runner-cpu
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -69,14 +50,11 @@ jobs:
         run: pre-commit run --all-files --show-diff-on-failure
 
   python-lint:
-    needs: [ci-gate]
     runs-on: k8s-runner-cpu
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -99,14 +77,11 @@ jobs:
         run: mypy bindings/python/ --config-file mypy.ini
 
   grpc-proto-build-check:
-    needs: [ci-gate]
     runs-on: k8s-runner-cpu
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -128,14 +103,11 @@ jobs:
           python -c "from smg_grpc_proto import sglang_scheduler_pb2; print('OK')"
 
   build-wheel:
-    needs: [ci-gate]
     runs-on: k8s-runner-gpu
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Cache wheel and Go FFI artifacts
         id: cache-wheel
@@ -261,14 +233,11 @@ jobs:
           pytest -q tests --cov=smg --cov-config=.coveragerc --cov-report=term-missing --cov-fail-under=80
 
   unit-tests:
-    needs: [ci-gate]
     runs-on: k8s-runner-cpu
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -390,9 +359,8 @@ jobs:
           retention-days: 7
 
   detect-changes:
-    needs: [ci-gate]
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
+    if: github.event_name == 'pull_request'
     permissions:
       contents: read
       pull-requests: read
@@ -465,7 +433,6 @@ jobs:
       && needs.build-wheel.result == 'success'
       && github.actor != 'dependabot[bot]'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.chat-completions == 'true')))
@@ -526,7 +493,6 @@ jobs:
       && needs.build-wheel.result == 'success'
       && github.actor != 'dependabot[bot]'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.embeddings == 'true')))
@@ -557,7 +523,6 @@ jobs:
       && needs.build-wheel.result == 'success'
       && github.actor != 'dependabot[bot]'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.chat-completions == 'true')))
@@ -611,7 +576,6 @@ jobs:
       && needs.build-wheel.result == 'success'
       && github.actor != 'dependabot[bot]'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.agentic == 'true')))
@@ -633,7 +597,6 @@ jobs:
       && !cancelled()
       && needs.e2e-1gpu-gateway.result == 'success'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.chat-completions == 'true')))
@@ -702,7 +665,6 @@ jobs:
       && needs.build-wheel.result == 'success'
       && github.actor != 'dependabot[bot]'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.agentic == 'true')))
@@ -850,7 +812,6 @@ jobs:
       && needs.build-wheel.result == 'success'
       && github.actor != 'dependabot[bot]'
       && (github.event_name != 'pull_request'
-          && github.event_name != 'pull_request_target'
           || (needs.detect-changes.result == 'success'
               && (needs.detect-changes.outputs.common == 'true'
                   || needs.detect-changes.outputs.go-bindings == 'true')))