diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1a5e26f..c0bda33 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -24,17 +24,24 @@ jobs:
         language: [ 'javascript' ]
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
+    - uses: actions/checkout@v2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+
+    - name: Read .nvmrc
+      id: nvm
+      run: echo ::set-output name=NVMRC::$(cat .nvmrc)
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ steps.nvm.outputs.NVMRC }}
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v1
       with:
         languages: ${{ matrix.language }}
 
-    - name: Install dependencies
-      run: npm ci
-
     - name: Build executable
       run: npm run package
 
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 981d97d..677a7c2 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -13,16 +13,30 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: GPR login
         run: docker login docker.pkg.github.com -u x -p ${{ secrets.GITHUB_TOKEN }}
+
       - name: GRP pull dependabot/dependabot-updater
         run: docker pull docker.pkg.github.com/dependabot/dependabot-updater:v1
+
       - name: GRP pull github/dependabot-update-job-proxy
         run: docker pull docker.pkg.github.com/github/dependabot-update-job-proxy:v1
-      - run: npm ci
-      - name: Run integration test files
+
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Read .nvmrc
+        id: nvm
+        run: echo ::set-output name=NVMRC::$(cat .nvmrc)
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ steps.nvm.outputs.NVMRC }}
+
+      - name: Install NPM dependencies
+        run: npm ci
+
+      - name: Run integration tests
         run: npm run test-integration
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 88da9e2..c7de449 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,20 +12,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
       - name: Read .nvmrc
         id: nvm
         run: echo ::set-output name=NVMRC::$(cat .nvmrc)
+
       - name: Setup Node.js
         uses: actions/setup-node@v1
         with:
           node-version: ${{ steps.nvm.outputs.NVMRC }}
-      - run: npm ci
-      - run: npm run all
+
+      - name: Install NPM dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm run all
+
       - run: git diff --quiet dist/
   test: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
       - uses: ./
         with:
           milliseconds: 1000