diff --git a/.github/workflows/health-69-consumer-sync-shadow-evidence.yml b/.github/workflows/health-69-consumer-sync-shadow-evidence.yml
index 9432471ee..61aa0a05b 100644
--- a/.github/workflows/health-69-consumer-sync-shadow-evidence.yml
+++ b/.github/workflows/health-69-consumer-sync-shadow-evidence.yml
@@ -2,11 +2,19 @@ name: Health 69 Consumer Sync Shadow Evidence
 
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/health-69-consumer-sync-shadow-evidence.yml'
+      - '.github/sync-manifest.yml'
+      - 'scripts/sync_manifest_compiler.py'
+      - 'scripts/build_consumer_sync_shadow_handoff.py'
+      - 'templates/consumer-repo/**'
   schedule:
     - cron: '17 8 * * 1'
   push:
     branches: [main]
     paths:
+      - '.github/workflows/health-69-consumer-sync-shadow-evidence.yml'
       - '.github/sync-manifest.yml'
       - 'scripts/sync_manifest_compiler.py'
       - 'scripts/build_consumer_sync_shadow_handoff.py'
diff --git a/tests/scripts/test_consumer_sync_shadow_handoff.py b/tests/scripts/test_consumer_sync_shadow_handoff.py
index bfa982c08..a1e43edd1 100644
--- a/tests/scripts/test_consumer_sync_shadow_handoff.py
+++ b/tests/scripts/test_consumer_sync_shadow_handoff.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -123,9 +124,8 @@ def test_cli_reports_invalid_plan_without_writing_handoff(tmp_path: Path) -> Non
 
 def test_workflow_has_no_write_or_apply_surface() -> None:
     root = Path(__file__).parents[2]
-    workflow = (
-        root / ".github" / "workflows" / "health-69-consumer-sync-shadow-evidence.yml"
-    ).read_text(encoding="utf-8")
+    workflow_path = root / ".github" / "workflows" / "health-69-consumer-sync-shadow-evidence.yml"
+    workflow = workflow_path.read_text(encoding="utf-8")
 
     assert "contents: read" in workflow
     assert "contents: write" not in workflow
@@ -135,7 +135,13 @@ def test_workflow_has_no_write_or_apply_surface() -> None:
     assert "write_authority" not in workflow.lower() or "Write authority: false" in workflow
     assert "persist-credentials: false" in workflow
     assert "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" in workflow
-    assert "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1" in workflow
+    setup_python_refs = re.findall(
+        r"uses:\s+actions/setup-python@[0-9a-f]{40}\s+# v\d+\b",
+        workflow,
+    )
+    assert len(setup_python_refs) == 1
+    assert "pull_request:" in workflow
+    assert f"- '{workflow_path.relative_to(root).as_posix()}'" in workflow
     assert "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" in workflow
     assert "pyyaml==6.0.2" in workflow
     assert (
diff --git a/tests/workflows/test_template_drift_workflow.py b/tests/workflows/test_template_drift_workflow.py
index 26cad474e..779d5cb9a 100644
--- a/tests/workflows/test_template_drift_workflow.py
+++ b/tests/workflows/test_template_drift_workflow.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from pathlib import Path
 
 import yaml
@@ -19,5 +20,15 @@ def test_template_drift_workflow_installs_pyyaml_before_checker() -> None:
     )
     prior_steps = steps[:checker_index]
 
-    assert any(step.get("uses") == "actions/setup-python@v6" for step in prior_steps)
+    setup_python_steps = [
+        step
+        for step in prior_steps
+        if re.fullmatch(r"actions/setup-python@v\d+", str(step.get("uses", "")))
+    ]
+
+    assert len(setup_python_steps) == 1
+    assert any(
+        re.fullmatch(r"actions/setup-python@v\d+", str(step.get("uses", "")))
+        for step in prior_steps
+    )
     assert any("pip install pyyaml" in step.get("run", "").lower() for step in prior_steps)