diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index 1e114c5c4..61869fa5f 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -1,6 +1,6 @@
 name: CI
 on:
-  pull_request:
+  pull_request_target:
     types:
       - labeled
       - opened
@@ -23,14 +23,29 @@ env:
 jobs:
   build:
     concurrency:
-      group: ${{ github.head_ref || github.run_id }}
+      group: build-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
     name: Build and Unit Test
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.vars.outputs.version }}
+      clustername: ${{ steps.vars.outputs.clustername }}
+      pr: ${{ steps.pr.outputs.result }}
     steps:
+      - name: Get PR ref
+        uses: actions/github-script@v7
+        id: pr
+        with:
+          script: |
+            const { data: pullRequest } = await github.rest.pulls.get({
+              ...context.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+            return pullRequest
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
+          ref: ${{fromJSON(steps.pr.outputs.result).merge_commit_sha}}
           fetch-depth: 0
       - name: Setup Go
         uses: actions/setup-go@v5
@@ -46,31 +61,6 @@ jobs:
       - name: Unit tests
         run: |
           make test
-      - name: Build HMC controller image
-        run: |
-          make docker-build
-
-  push:
-    concurrency:
-      group: push-${{ github.head_ref || github.run_id }}
-      cancel-in-progress: true
-    name: E2E Push Images and Charts to GHCR
-    runs-on: ubuntu-latest
-    needs: build
-    if: ${{ contains( github.event.pull_request.labels.*.name, 'test e2e') }}
-    outputs:
-      version: ${{ steps.vars.outputs.version }}
-      clustername: ${{ steps.vars.outputs.clustername }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          cache: false
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v3
       - name: Login to GHCR
@@ -85,8 +75,7 @@ jobs:
           GIT_VERSION=$(git describe --tags --always)
           echo "version=${GIT_VERSION:1}" >> $GITHUB_OUTPUT
           echo "clustername=ci-$(date +%s | cut -b6-10)" >> $GITHUB_OUTPUT
-      - name: Push HMC Controller Image to GHCR
-        if:
+      - name: Build and push HMC controller image
         uses: docker/build-push-action@v6
         with:
           build-args: |
@@ -98,7 +87,7 @@ jobs:
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
-      - name: Prepare and push HMC template charts to GHCR
+      - name: Prepare and push HMC template charts
         run: |
           make hmc-chart-release
           make helm-push
@@ -106,27 +95,28 @@ jobs:
   controller-e2etest:
     name: E2E Controller
     runs-on: ubuntu-latest
-    if: ${{ contains( github.event.pull_request.labels.*.name, 'test e2e') }}
-    needs: push
+    needs: build
     concurrency:
       group: controller-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
     outputs:
-      clustername: ${{ needs.push.outputs.clustername }}
-      version: ${{ needs.push.outputs.version }}
+      clustername: ${{ needs.build.outputs.clustername }}
+      version: ${{ needs.build.outputs.version }}
+      pr: ${{ needs.build.outputs.pr }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{fromJSON(needs.build.outputs.pr).merge_commit_sha}}
       - name: Setup kubectl
         uses: azure/setup-kubectl@v4
       - name: Run E2E tests
         env:
           GINKGO_LABEL_FILTER: 'controller'
-          MANAGED_CLUSTER_NAME: ${{ needs.push.outputs.clustername }}
-          IMG: 'ghcr.io/mirantis/hmc/controller-ci:${{ needs.push.outputs.version }}'
-          VERSION: ${{ needs.push.outputs.version }}
+          MANAGED_CLUSTER_NAME: ${{ needs.build.outputs.clustername }}
+          IMG: 'ghcr.io/mirantis/hmc/controller-ci:${{ needs.build.outputs.version }}'
+          VERSION: ${{ needs.build.outputs.version }}
         run: |
           make test-e2e
       - name: Archive test results
@@ -141,13 +131,14 @@ jobs:
     name: E2E Cloud Providers
     runs-on: ubuntu-latest
     if: ${{ contains( github.event.pull_request.labels.*.name, 'test e2e') }}
-    needs: push
+    needs: build
     concurrency:
       group: cloud-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
     outputs:
-      clustername: ${{ needs.push.outputs.clustername }}
-      version: ${{ needs.push.outputs.version }}
+      clustername: ${{ needs.build.outputs.clustername }}
+      version: ${{ needs.build.outputs.version }}
+      pr: ${{ needs.build.outputs.pr }}
     env:
       AWS_REGION: us-west-2
       AWS_ACCESS_KEY_ID: ${{ secrets.CI_AWS_ACCESS_KEY_ID }}
@@ -162,6 +153,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{fromJSON(needs.build.outputs.pr).merge_commit_sha}}
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -172,9 +164,9 @@ jobs:
       - name: Run E2E tests
         env:
           GINKGO_LABEL_FILTER: 'provider:cloud'
-          MANAGED_CLUSTER_NAME: ${{ needs.push.outputs.clustername }}
-          IMG: 'ghcr.io/mirantis/hmc/controller-ci:${{ needs.push.outputs.version }}'
-          VERSION: ${{ needs.push.outputs.version }}
+          MANAGED_CLUSTER_NAME: ${{ needs.build.outputs.clustername }}
+          IMG: 'ghcr.io/mirantis/hmc/controller-ci:${{ needs.build.outputs.version }}'
+          VERSION: ${{ needs.build.outputs.version }}
         run: |
           make test-e2e
       - name: Archive test results
@@ -189,13 +181,14 @@ jobs:
     name: E2E On-Prem Providers
     runs-on: self-hosted
     if: ${{ contains( github.event.pull_request.labels.*.name, 'test e2e') }}
-    needs: push
+    needs: build
     concurrency:
       group: onprem-${{ github.head_ref || github.run_id }}
       cancel-in-progress: true
     outputs:
-      clustername: ${{ needs.push.outputs.clustername }}
-      version: ${{ needs.push.outputs.version }}
+      clustername: ${{ needs.build.outputs.clustername }}
+      version: ${{ needs.build.outputs.version }}
+      pr: ${{ needs.build.outputs.pr }}
     env:
       VSPHERE_USER: ${{ secrets.CI_VSPHERE_USER }}
       VSPHERE_PASSWORD: ${{ secrets.CI_VSPHERE_PASSWORD }}
@@ -214,6 +207,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{fromJSON(needs.build.outputs.pr).merge_commit_sha}}
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -223,9 +217,9 @@ jobs:
       - name: Run E2E tests
         env:
           GINKGO_LABEL_FILTER: 'provider:onprem'
-          MANAGED_CLUSTER_NAME: ${{ needs.push.outputs.clustername }}
-          IMG: 'ghcr.io/mirantis/hmc/controller-ci:${{ needs.push.outputs.version }}'
-          VERSION: ${{ needs.push.outputs.version }}
+          MANAGED_CLUSTER_NAME: ${{ needs.build.outputs.clustername }}
+          IMG: 'ghcr.io/mirantis/hmc/controller-ci:${{ needs.build.outputs.version }}'
+          VERSION: ${{ needs.build.outputs.version }}
         run: |
           make test-e2e
       - name: Archive test results
@@ -237,21 +231,23 @@ jobs:
             test/e2e/*.log
 
   cleanup:
-    name: E2E Cleanup
+    name: Cleanup
     needs:
-      - push
+      - build
       - provider-cloud-e2etest
     runs-on: ubuntu-latest
-    if: ${{ always() && !contains(needs.provider-cloud-e2etest.result, 'skipped') && contains(needs.push.result, 'success') }}
+    if: ${{ always() && !contains(needs.provider-cloud-e2etest.result, 'skipped') && contains(needs.build.result, 'success') }}
     timeout-minutes: 15
     outputs:
-      clustername: ${{ needs.push.outputs.clustername }}
-      version: ${{ needs.push.outputs.version }}
+      clustername: ${{ needs.build.outputs.clustername }}
+      version: ${{ needs.build.outputs.version }}
+      pr: ${{ needs.build.outputs.pr }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{fromJSON(needs.build.outputs.pr).merge_commit_sha}}
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -266,7 +262,7 @@ jobs:
           AZURE_TENANT_ID: ${{ secrets.CI_AZURE_TENANT_ID }}
           AZURE_CLIENT_ID: ${{ secrets.CI_AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.CI_AZURE_CLIENT_SECRET }}
-          CLUSTER_NAME: '${{ needs.push.outputs.clustername }}'
+          CLUSTER_NAME: '${{ needs.build.outputs.clustername }}'
         run: |
           make dev-aws-nuke
           make dev-azure-nuke
\ No newline at end of file