diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index 65807d9..e570e8f 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -1,7 +1,10 @@
 name: gitleaks
 
+# push only on main: PR branches are already covered by the pull_request
+# run, and an unscoped push trigger fired a duplicate run on every PR.
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:  # allow manual runs from the Actions tab
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6dafb5f..0c8bcc9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,7 +1,10 @@
 name: tests
 
+# push only on main: PR branches are already covered by the pull_request
+# run, and an unscoped push trigger fired a duplicate run on every PR.
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:  # allow manual runs from the Actions tab
 
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index ea06c73..4cb6caf 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -1,7 +1,10 @@
 name: web
 
+# push only on main: PR branches are already covered by the pull_request
+# run, and an unscoped push trigger fired a duplicate run on every PR.
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:  # allow manual runs from the Actions tab