diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d8a46b1f..dd1705520 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_call:
   pull_request:
   # merge queue is required so all commits on target branches trigger this workflow
   # despite lack of the push event trigger here
@@ -46,9 +47,6 @@ jobs:
   lint-workflows:
     name: Lint workflows
     runs-on: ubuntu-latest
-    permissions:
-      actions: read # only required in private repos
-      security-events: write # allow writing security events
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -99,7 +97,7 @@ jobs:
 
       - name: Upload coverage
         uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
-        if: matrix.node_version == 24
+        if: matrix.node_version == 24 && github.event_name != 'workflow_call'
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 99afb51e7..46a22ded5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -43,10 +43,16 @@ jobs:
         with:
           version: pnpm version-packages
 
-  publish:
-    name: Publish
+  ci:
     if: needs.version.outputs.hasChangesets == 'false'
     needs: version
+    permissions:
+      contents: read
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Publish
+    needs: ci
     runs-on: ubuntu-latest
     environment: npm
     timeout-minutes: 20