diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 5019746a4f76..cd77e17de21c 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -41,6 +41,7 @@ jobs:
   config_workflow:
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     needs: []
+    if: ${{ github.repository == github.event.pull_request.head.repo.full_name }}
     name: "Config Workflow"
     outputs:
       data: ${{ steps.run.outputs.DATA }}
diff --git a/ci/jobs/scripts/find_tests.py b/ci/jobs/scripts/find_tests.py
index e2ff55eeb2a7..7dc90f4058dd 100644
--- a/ci/jobs/scripts/find_tests.py
+++ b/ci/jobs/scripts/find_tests.py
@@ -54,7 +54,12 @@ class Targeting:
     def __init__(self, info: Info, branch: str = ""):
         self.info = info
         self.branch = branch or getattr(info, 'base_branch', '')
-        self.cidb = CIDBCluster()
+        # NOTE (strtgbb): Read credentials from env directly to avoid
+        # a mutation bug in CIDBCluster's secret resolution path.
+        url = os.environ.get(Settings.SECRET_CI_DB_URL, "")
+        user = os.environ.get(Settings.SECRET_CI_DB_USER, "")
+        pwd = os.environ.get(Settings.SECRET_CI_DB_PASSWORD, "")
+        self.cidb = CIDBCluster(url=url, user=user, pwd=pwd)
         if "stateless" in info.job_name.lower():
             self.job_type = self.STATELESS_JOB_TYPE
         elif "integration" in info.job_name.lower():
diff --git a/ci/jobs/scripts/functional_tests/export_coverage.py b/ci/jobs/scripts/functional_tests/export_coverage.py
index 285844fdc533..dcef84a76218 100644
--- a/ci/jobs/scripts/functional_tests/export_coverage.py
+++ b/ci/jobs/scripts/functional_tests/export_coverage.py
@@ -62,11 +62,12 @@ def do(self):
 
             if not self.to_file:
                 query = (
-                    f"INSERT INTO FUNCTION remoteSecure('{self.dest.url.removeprefix('https://')}', '{Settings.CI_DB_DB_NAME}.checks_coverage_inverted', '{self.dest.user}', '{self.dest.pwd}') "
+                    f"INSERT INTO FUNCTION remoteSecure('{self.dest.url.removeprefix('https://').split(':')[0]}', '{Settings.CI_DB_DB_NAME}.checks_coverage_inverted', '{self.dest.user}', '{self.dest.pwd}') "
+                    "(branch, symbol, check_start_time, check_name, test_name) "
                     "SELECT DISTINCT "
+                    f"'{self.branch}' AS branch, "
                     "arrayJoin(symbol) AS symbol, "
                     f"'{self.check_start_time}' AS check_start_time, "
-                    f"'{self.branch}' AS branch, "
                     f"'{self.job_name}' AS check_name, "
                     "test_name "
                     f"FROM system.{table}"
diff --git a/ci/workflows/pull_request.py b/ci/workflows/pull_request.py
index dbb44c188389..e92e55bd9b13 100644
--- a/ci/workflows/pull_request.py
+++ b/ci/workflows/pull_request.py
@@ -37,6 +37,7 @@
     name="PR",
     event=Workflow.Event.PULL_REQUEST,
     base_branches=[BASE_BRANCH, "releases/*", "antalya-*"],
+    if_condition="github.repository == github.event.pull_request.head.repo.full_name",
     jobs=[
         # JobConfigs.style_check, # NOTE (strtgbb): we don't run style check
         # JobConfigs.docs_job, # NOTE (strtgbb): we don't build docs