diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
new file mode 100644
index 00000000..294d2689
--- /dev/null
+++ b/.github/workflows/ci-checks.yml
@@ -0,0 +1,134 @@
+name: CI checks
+
+on:
+  workflow_call:
+    inputs:
+      runner:
+        description: Runner label for CI jobs
+        required: true
+        type: string
+      publish-stainless-artifact:
+        description: Build and upload an installable Stainless artifact
+        required: true
+        type: boolean
+
+permissions: {}
+
+jobs:
+  stainless-artifact:
+    timeout-minutes: 10
+    name: stainless artifact
+    if: inputs.publish-stainless-artifact
+    permissions:
+      contents: read
+      id-token: write # Authenticate the artifact upload to pkg.stainless.com.
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
+        with:
+          bundler-cache: false
+      - run: bundle install
+
+      - name: Get GitHub OIDC token
+        id: github-oidc
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: core.setOutput('github_token', await core.getIDToken());
+
+      - name: Build and upload gem artifacts
+        env:
+          URL: https://pkg.stainless.com/s
+          AUTH: ${{ steps.github-oidc.outputs.github_token }}
+          SHA: ${{ github.sha }}
+          PACKAGE_NAME: openai
+        run: ./scripts/utils/upload-artifact.sh
+
+  lint:
+    timeout-minutes: 10
+    name: lint
+    permissions:
+      contents: read
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
+        with:
+          ruby-version: '3.2'
+          bundler-cache: false
+      - run: bundle install
+      - name: Run lints
+        run: ./scripts/lint
+
+  package:
+    timeout-minutes: 10
+    name: package
+    permissions:
+      contents: read
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
+        with:
+          ruby-version: '3.2'
+          bundler-cache: false
+      - run: bundle install
+      - name: Build gem
+        run: bundle exec rake build:gem
+
+  test-ruby:
+    timeout-minutes: 10
+    name: test (ruby ${{ matrix.ruby-version }})
+    permissions:
+      contents: read
+    runs-on: ${{ inputs.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version: ['3.2', '3.3', '3.4', '4.0']
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: false
+      - run: bundle install
+      - name: Run tests
+        run: ./scripts/test
+
+  required:
+    timeout-minutes: 5
+    name: ci-required
+    # Keep branch protection on one stable context as the job matrix evolves.
+    needs:
+      - stainless-artifact
+      - lint
+      - package
+      - test-ruby
+    if: ${{ always() }}
+    permissions: {}
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Check required job results
+        env:
+          ARTIFACT_RESULT: ${{ needs.stainless-artifact.result }}
+          LINT_RESULT: ${{ needs.lint.result }}
+          PACKAGE_RESULT: ${{ needs.package.result }}
+          TEST_RESULT: ${{ needs.test-ruby.result }}
+        run: |
+          test "$ARTIFACT_RESULT" = "success" || test "$ARTIFACT_RESULT" = "skipped"
+          test "$LINT_RESULT" = "success"
+          test "$PACKAGE_RESULT" = "success"
+          test "$TEST_RESULT" = "success"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c205ee0d..6c5c3d99 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,9 @@
 name: CI
+
+# This workflow is shared by the Stainless staging repository and the OpenAI
+# production repository. Stainless feature branches use push runs so they can
+# publish installable artifacts; production feature branches use PR runs so a
+# commit is validated only once.
 on:
   push:
     branches:
@@ -14,101 +19,32 @@ on:
       - 'stl-preview-head/**'
       - 'stl-preview-base/**'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
-  build:
-    timeout-minutes: 10
-    name: build
+  checks:
+    name: ci
+    if: >-
+      (startsWith(github.repository, 'stainless-sdks/') &&
+        (github.event_name == 'push' || github.event.pull_request.head.repo.fork)) ||
+      (!startsWith(github.repository, 'stainless-sdks/') &&
+        (github.event_name == 'pull_request' ||
+          github.ref == 'refs/heads/main' ||
+          github.ref == 'refs/heads/next'))
     permissions:
       contents: read
-      id-token: write
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: |-
-      github.repository == 'stainless-sdks/openai-ruby' &&
-      (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
-        with:
-          bundler-cache: false
-      - run: |-
-          bundle install
-
-      - name: Get GitHub OIDC Token
-        if: |-
+      id-token: write # Allow the called artifact job to mint its Stainless upload token.
+    uses: ./.github/workflows/ci-checks.yml
+    with:
+      runner: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+      publish-stainless-artifact: >-
+        ${{
           github.repository == 'stainless-sdks/openai-ruby' &&
+          (github.event_name == 'push' || github.event.pull_request.head.repo.fork) &&
+          (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata') &&
           !startsWith(github.ref, 'refs/heads/stl/')
-        id: github-oidc
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
-        with:
-          script: core.setOutput('github_token', await core.getIDToken());
-
-      - name: Build and upload gem artifacts
-        if: |-
-          github.repository == 'stainless-sdks/openai-ruby' &&
-          !startsWith(github.ref, 'refs/heads/stl/')
-        env:
-          URL: https://pkg.stainless.com/s
-          AUTH: ${{ steps.github-oidc.outputs.github_token }}
-          SHA: ${{ github.sha }}
-          PACKAGE_NAME: openai
-        run: ./scripts/utils/upload-artifact.sh
-  lint:
-    timeout-minutes: 10
-    name: lint
-    permissions:
-      contents: read
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
-
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
-        with:
-          bundler-cache: false
-      - run: |-
-          bundle install
-
-      - name: Run lints
-        run: ./scripts/lint
-  test-ruby:
-    timeout-minutes: 10
-    name: test (ruby ${{ matrix.ruby-version }})
-    permissions:
-      contents: read
-    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
-    strategy:
-      fail-fast: false
-      matrix:
-        ruby-version: ['3.2', '3.3', '3.4', '4.0']
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
-        with:
-          ruby-version: ${{ matrix.ruby-version }}
-          bundler-cache: false
-      - run: |-
-          bundle install
-
-      - name: Run tests
-        run: ./scripts/test
-  test:
-    name: test
-    needs: test-ruby
-    if: ${{ always() && needs.test-ruby.result != 'skipped' }}
-    permissions: {}
-    runs-on: ${{ github.repository == 'stainless-sdks/openai-ruby' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    steps:
-      - if: ${{ needs.test-ruby.result == 'failure' || needs.test-ruby.result == 'cancelled' }}
-        run: exit 1
+        }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7d3654ec..02c57284 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,6 +4,13 @@ on:
   push:
     branches:
       - main
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 permissions: {}
 
@@ -13,9 +20,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
-      actions: read
-      contents: read
-      security-events: write
+      actions: read # Fetch workflow metadata for CodeQL analysis.
+      contents: read # Check out and analyze repository contents.
+      security-events: write # Upload CodeQL results to code scanning.
     strategy:
       fail-fast: false
       matrix: