diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
index 4603178..2305ffc 100644
--- a/.github/workflows/deploy-preview.yml
+++ b/.github/workflows/deploy-preview.yml
@@ -2,21 +2,20 @@ name: Deploy preview
 
 on:
   pull_request:
-    branches:
-      - main
-  workflow_dispatch:
 
 permissions:
-  checks: write
-  contents: read
-  pull-requests: write
+  checks: write # for FirebaseExtended/action-hosting-deploy to create a check run
+  contents: read # for actions/checkout to read the repository
+  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
 
 jobs:
   deploy:
-    if: ${{ github.actor != 'dependabot[bot]' }}
+    if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-node
       # Run dev mode build to generate the `e2eRoute`
       # @see dev/ag-grid-angular/src/main.ts
@@ -26,6 +25,6 @@ jobs:
           repoToken: ${{ secrets.GITHUB_TOKEN }}
           firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}
           firebaseToolsVersion: ^13.35.1
-          expires: 5d
+          expires: 3d
           target: next
           channelId: data-grid-pr-${{ github.event.number }}
diff --git a/.github/workflows/e2e-approve-snapshots.yml b/.github/workflows/e2e-approve-snapshots.yml
index da4c207..d398dcb 100644
--- a/.github/workflows/e2e-approve-snapshots.yml
+++ b/.github/workflows/e2e-approve-snapshots.yml
@@ -1,3 +1,8 @@
+# Triggered workflow by PR comment: /approve-snapshots
+#
+# ⚠️ This job checks out and runs PR-controlled code with a repo write token. Only comment
+# /approve-snapshots after reviewing the PR's contents — the author_association check below
+# only verifies the commenter, not the safety of the code being run.
 name: E2E approve snapshots
 
 on:
@@ -5,34 +10,51 @@ on:
     types: [created]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: write # for stefanzweifel/git-auto-commit-action to push changes
+  issues: write # for actions/github-script to react to the triggering comment
+  pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs
 
 jobs:
   approve_snapshots:
-    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') }}
+    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }}
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
       - uses: xt0rted/pull-request-comment-branch@v3
         id: comment-branch
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'eyes',
+            });
       - uses: actions/checkout@v7
         with:
           ref: ${{ steps.comment-branch.outputs.head_ref }}
-      - uses: thollander/actions-comment-pull-request@v3
-        with:
-          message: 🔄 [Updating](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots.
       - run: npm run e2e:docker:update-snapshots
       - uses: stefanzweifel/git-auto-commit-action@v7
         id: commit-and-push
         with:
           commit_message: 'test: updated e2e snapshots'
           file_pattern: '**/*.png **/*.txt'
-      - uses: thollander/actions-comment-pull-request@v3
+      - uses: actions/github-script@v7
         if: ${{ steps.commit-and-push.outputs.changes_detected == 'true' }}
         with:
-          message: ✅ Snapshots [updated](https://github.com/${{ github.repository }}/pull/${{ github.event.issue.number }}/commits/${{ steps.commit-and-push.outputs.commit_hash }})!
+          script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'rocket',
+            });
       - uses: thollander/actions-comment-pull-request@v3
         if: ${{ steps.commit-and-push.outputs.changes_detected != 'true' }}
         with:
           message: ⚠️ No snapshots changes detected.
+      - uses: thollander/actions-comment-pull-request@v3
+        if: ${{ failure() }}
+        with:
+          message: 🚨 Failed to [update](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots.
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 84d4625..0719b72 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -7,8 +7,8 @@ on:
   pull_request:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read # for actions/checkout to read the repository
+  pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs
 
 jobs:
   tests:
diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml
new file mode 100644
index 0000000..3efa164
--- /dev/null
+++ b/.github/workflows/redeploy-preview.yml
@@ -0,0 +1,64 @@
+# Triggered workflow by PR comment: /redeploy-preview
+#
+# ⚠️ This job checks out and builds PR-controlled code with a Firebase deployment secret.
+# Only comment /redeploy-preview after reviewing the PR's contents — the author_association
+# check below only verifies the commenter, not the safety of the code being built.
+name: Redeploy documentation preview
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  checks: write # for FirebaseExtended/action-hosting-deploy to create a check run
+  contents: read # for actions/checkout to read the repository
+  issues: write # for actions/github-script to react to the triggering comment
+  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
+
+jobs:
+  redeploy:
+    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: xt0rted/pull-request-comment-branch@v3
+        id: comment-branch
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'eyes',
+            });
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.comment-branch.outputs.head_ref }}
+          persist-credentials: false
+      - uses: ./.github/actions/setup-node
+      # Run dev mode build to generate the `e2eRoute`
+      # @see dev/ag-grid-angular/src/main.ts
+      - run: yarn run build --configuration=development
+      - uses: FirebaseExtended/action-hosting-deploy@v0.11.0
+        with:
+          repoToken: '${{ secrets.GITHUB_TOKEN }}'
+          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}'
+          firebaseToolsVersion: ^13.35.1
+          expires: 3d
+          channelId: data-grid-pr-${{ github.event.issue.number }}
+          projectId: koobiq
+          target: next
+      - uses: actions/github-script@v7
+        if: ${{ success() }}
+        with:
+          script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'rocket',
+            });
+      - uses: thollander/actions-comment-pull-request@v3.0.1
+        if: ${{ failure() }}
+        with:
+          message: 🚨 Failed to [redeploy](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview.