diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..5d5453971
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,16 @@
+name: Build
+
+on:
+  pull_request:
+
+permissions:
+  contents: read # for actions/checkout to read the repository
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/workflows/actions/setup-node
+      - uses: ./.github/workflows/actions/build-packages
+      - uses: ./.github/workflows/actions/build-docs
diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
new file mode 100644
index 000000000..aaa73b1e7
--- /dev/null
+++ b/.github/workflows/deploy-preview.yml
@@ -0,0 +1,28 @@
+name: Deploy documentation preview
+
+on:
+  pull_request:
+
+permissions:
+  checks: write # for FirebaseExtended/action-hosting-deploy to create a check run
+  contents: read # for actions/checkout to read the repository
+  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
+
+jobs:
+  deploy:
+    if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/workflows/actions/setup-node
+      - uses: ./.github/workflows/actions/build-packages
+      - uses: ./.github/workflows/actions/build-docs
+      - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
+        with:
+          repoToken: '${{ secrets.GITHUB_TOKEN }}'
+          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}'
+          firebaseToolsVersion: '15.3.1'
+          expires: 3d
+          channelId: prs-${{ github.event.number }}
+          projectId: koobiq
+          target: next
diff --git a/.github/workflows/e2e-approve-snapshots.yml b/.github/workflows/e2e-approve-snapshots.yml
index ea2535e5c..1921d5e9a 100644
--- a/.github/workflows/e2e-approve-snapshots.yml
+++ b/.github/workflows/e2e-approve-snapshots.yml
@@ -1,3 +1,8 @@
+# Triggered workflow by PR comment: /approve-snapshots
+#
+# ⚠️ This job checks out and runs PR-controlled code with a repo write token. Only comment
+# /approve-snapshots after reviewing the PR's contents — the author_association check below
+# only verifies the commenter, not the safety of the code being run.
 name: E2E approve snapshots
 
 on:
@@ -5,12 +10,12 @@ on:
     types: [created]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: write # for stefanzweifel/git-auto-commit-action to push changes
+  pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs
 
 jobs:
   approve_snapshots:
-    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') }}
+    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
diff --git a/.github/workflows/pr-docs-preview.yml b/.github/workflows/pr-docs-preview.yml
deleted file mode 100644
index 0dcab6749..000000000
--- a/.github/workflows/pr-docs-preview.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Deploy to Hosting on PR
-
-on:
-  pull_request:
-    branches:
-      - main
-
-permissions:
-  checks: write
-  contents: read
-  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
-
-jobs:
-  deploy_live:
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
-          fetch-depth: 0
-
-      - name: Setup Node
-        uses: ./.github/workflows/actions/setup-node
-
-      - name: Build Packages
-        uses: ./.github/workflows/actions/build-packages
-
-      - name: Build Documentation
-        uses: ./.github/workflows/actions/build-docs
-
-      - name: Deploy Documentation
-        if: github.actor != 'dependabot[bot]'
-        uses: FirebaseExtended/action-hosting-deploy@e2eda2e106cfa35cdbcf4ac9ddaf6c4756df2c8c # v0.10.0
-        with:
-          repoToken: '${{ secrets.GITHUB_TOKEN }}'
-          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}'
-          firebaseToolsVersion: '15.3.1'
-          expires: 5d
-          channelId: prs-${{ github.event.number }}
-          projectId: koobiq
-          target: next
diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml
new file mode 100644
index 000000000..1135ef169
--- /dev/null
+++ b/.github/workflows/redeploy-preview.yml
@@ -0,0 +1,45 @@
+# Triggered workflow by PR comment: /redeploy-preview
+#
+# ⚠️ This job checks out and builds PR-controlled code with a Firebase deployment secret.
+# Only comment /redeploy-preview after reviewing the PR's contents — the author_association
+# check below only verifies the commenter, not the safety of the code being built.
+name: Redeploy documentation preview
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  checks: write # for FirebaseExtended/action-hosting-deploy to create a check run
+  contents: read # for actions/checkout to read the repository
+  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
+
+jobs:
+  redeploy:
+    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0
+        id: comment-branch
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+        with:
+          message: 🔄 [Redeploying](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ steps.comment-branch.outputs.head_ref }}
+      - uses: ./.github/workflows/actions/setup-node
+      - uses: ./.github/workflows/actions/build-packages
+      - uses: ./.github/workflows/actions/build-docs
+      - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
+        with:
+          repoToken: '${{ secrets.GITHUB_TOKEN }}'
+          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}'
+          firebaseToolsVersion: '15.3.1'
+          expires: 3d
+          channelId: prs-${{ github.event.issue.number }}
+          projectId: koobiq
+          target: next
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+        if: ${{ failure() }}
+        with:
+          message: 🚨 Failed to [redeploy](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview.