diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index bb372f196b83..31d3932e2cd4 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -10,6 +10,10 @@ on:
       - staging-*
       - haskell-updates
   workflow_call:
+    inputs:
+      mergedSha:
+        required: true
+        type: string
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
@@ -43,5 +47,5 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
-      mergedSha: ${{ github.sha }}
+      mergedSha: ${{ inputs.mergedSha || github.sha }}
       systems: ${{ needs.prepare.outputs.systems }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a90c13c3f738..c28ca61817c5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,9 +13,27 @@ jobs:
   prepare:
     runs-on: ubuntu-24.04-arm
     outputs:
+      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
       pr: ${{ steps.files.outputs.pr }}
       push: ${{ steps.files.outputs.push }}
     steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout-cone-mode: true # default, for clarity
+          sparse-checkout: |
+            ci/github-script
+      - id: prepare
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            require('./ci/github-script/prepare.js')({
+              github,
+              context,
+              core,
+              // Review comments will be posted by the main PR workflow on the pull_request_target event.
+              dry: false,
+            })
+
       - name: Determine changed files
         id: files
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
@@ -70,3 +88,5 @@ jobs:
       statuses: write
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}