diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 000000000..aa442194b
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+# we set `sdp-backend` as code owners
+# require approval from 1 member of `sdp-backend` team
+@stellar/sdp-backend
\ No newline at end of file
diff --git a/.github/workflows/anchor_platform_integration_check.yml b/.github/workflows/anchor_platform_integration_check.yml
index 2890220ee..6895456a8 100644
--- a/.github/workflows/anchor_platform_integration_check.yml
+++ b/.github/workflows/anchor_platform_integration_check.yml
@@ -8,9 +8,13 @@ on:
       - "release/**"
       - "releases/**"
       - "hotfix/**"
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
   workflow_call: # allows this workflow to be called from another workflow
 
+permissions:
+  contents: read
+
 jobs:
   anchor-integration:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/e2e_integration_test.yml b/.github/workflows/e2e_integration_test.yml
index 3bd0e70df..a84a619c9 100644
--- a/.github/workflows/e2e_integration_test.yml
+++ b/.github/workflows/e2e_integration_test.yml
@@ -8,9 +8,13 @@ on:
       - "release/**"
       - "releases/**"
       - "hotfix/**"
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
   workflow_call: # allows this workflow to be called from another workflow
 
+permissions:
+  contents: read
+
 env:
   USER_EMAIL: "sdp_user@stellar.org"
   USER_PASSWORD: "mockPassword123!"