diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7e6ac4be..6f0ca959 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -51,36 +51,7 @@ jobs:
         run: make docs
   run_test:
     needs: run_lint
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_DB: testdb
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres # pragma: allowlist secret
-          POSTGRES_HOST_AUTH_METHOD: trust
-          LC_COLLATE: en_US.UTF8
-          LC_CTYPE: en_US.UTF8
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-      - uses: actions/checkout@v7
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
-          python-version: "3.14.6"
-      - name: Install dependencies
-        run: make install
-      - name: Run tests
-        run: make test
+    uses: ./.github/workflows/test.yaml
 
   cronjobs-test:
     needs: run_test
diff --git a/.github/workflows/ingestion-job-publish.yaml b/.github/workflows/ingestion-job-publish.yaml
index 189e9b2b..112bbb76 100644
--- a/.github/workflows/ingestion-job-publish.yaml
+++ b/.github/workflows/ingestion-job-publish.yaml
@@ -23,7 +23,7 @@
 #       publish: $\{{ github.event_name != 'pull_request' }}
 #  ```
 #
-name: Build and Publish Docker Container
+name: Build and Publish Ingestion Docker Container
 
 on:
   workflow_call:
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 79d7773d..45d220c4 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -55,8 +55,16 @@ jobs:
           check browser_tests  '^.github/workflows/|^browser-tests/'
           check git_reader     '^.github/workflows/|^git-reader/'
 
+  # Make sure we don't deploy images with failing tests.
+  # On pull-requests, tests are already ran in CI.
+  tests:
+    if: github.event_name != 'pull_request'
+    uses: ./.github/workflows/test.yaml
+
   server_container:
     # Always build the server (since it depends on lots of files uv.lock, dockerfiles, kinto-slack, etc.)
+    needs: tests
+    if: ${{ !cancelled() && needs.tests.result != 'failure' }}
     env:
       DOCKERHUB_IMAGE_NAME: mozilla/remote-settings
       GAR_IMAGE_NAME: remote-settings
@@ -184,7 +192,7 @@ jobs:
           SRC: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GAR_REPOSITORY}}/remote-settings:${{ env.LATEST_TAG }}
         run: |
           for tag in $TAGS; do
-            docker buildx imagetools create --tag "${tag}" "${SRC}" 
+            docker buildx imagetools create --tag "${tag}" "${SRC}"
           done
       - name: Notify DEVs of build failure
         if: failure()
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
new file mode 100644
index 00000000..f68ff3db
--- /dev/null
+++ b/.github/workflows/test.yaml
@@ -0,0 +1,42 @@
+name: Tests
+
+# Reusable workflow so the exact same test suite gates both CI checks
+# (ci.yaml) and the deployable image build (publish.yaml).
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  run_test:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_DB: testdb
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres # pragma: allowlist secret
+          POSTGRES_HOST_AUTH_METHOD: trust
+          LC_COLLATE: en_US.UTF8
+          LC_CTYPE: en_US.UTF8
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.14.6"
+      - name: Install dependencies
+        run: make install
+      - name: Run tests
+        run: make test