diff --git a/.github/workflows/build-and-bench.yml b/.github/workflows/build-and-bench.yml
index 221904aa5..23587e7bc 100644
--- a/.github/workflows/build-and-bench.yml
+++ b/.github/workflows/build-and-bench.yml
@@ -7,6 +7,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -19,6 +20,7 @@ permissions:
 jobs:
   build:
 
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
diff --git a/.github/workflows/build-and-run-examples.yml b/.github/workflows/build-and-run-examples.yml
index 68ef14ee5..8627efc76 100644
--- a/.github/workflows/build-and-run-examples.yml
+++ b/.github/workflows/build-and-run-examples.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [ 'master', 'main', 'release/**' ]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -22,6 +23,7 @@ jobs:
             debug: [ '', 'DEBUG_VERBOSE=1' ]
             test: [ '', '--test' ]
             auth: [ '', 'AUTH=1' ]
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
diff --git a/.github/workflows/build-and-test-clientonly.yml b/.github/workflows/build-and-test-clientonly.yml
index 20de6a0af..944c609a8 100644
--- a/.github/workflows/build-and-test-clientonly.yml
+++ b/.github/workflows/build-and-test-clientonly.yml
@@ -7,6 +7,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -21,6 +22,7 @@ jobs:
     strategy:
         matrix:
             transport: [ 'tcp', 'tls' ]
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
diff --git a/.github/workflows/build-and-test-refactor.yml b/.github/workflows/build-and-test-refactor.yml
index 1563eb6bc..a3d962e3a 100644
--- a/.github/workflows/build-and-test-refactor.yml
+++ b/.github/workflows/build-and-test-refactor.yml
@@ -7,6 +7,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -22,7 +23,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        # Exclude macOS for draft PRs due to its small pool
+        os: >-
+          ${{ (github.event_name == 'pull_request' &&
+          github.event.pull_request.draft) &&
+          fromJSON('["ubuntu-latest"]') ||
+          fromJSON('["ubuntu-latest", "macos-latest"]') }}
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
diff --git a/.github/workflows/build-and-test-stress.yml b/.github/workflows/build-and-test-stress.yml
index 0935b7d7f..00923acdb 100644
--- a/.github/workflows/build-and-test-stress.yml
+++ b/.github/workflows/build-and-test-stress.yml
@@ -7,6 +7,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -19,6 +20,7 @@ permissions:
 jobs:
   build:
 
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
diff --git a/.github/workflows/build-and-test-whnvmtool.yml b/.github/workflows/build-and-test-whnvmtool.yml
index 8c1c9425b..d69b4e135 100644
--- a/.github/workflows/build-and-test-whnvmtool.yml
+++ b/.github/workflows/build-and-test-whnvmtool.yml
@@ -7,6 +7,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -19,6 +20,7 @@ permissions:
 jobs:
   build:
 
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
diff --git a/.github/workflows/build-and-test-wolfssl-lib.yml b/.github/workflows/build-and-test-wolfssl-lib.yml
index ba146bafe..d3505e36d 100644
--- a/.github/workflows/build-and-test-wolfssl-lib.yml
+++ b/.github/workflows/build-and-test-wolfssl-lib.yml
@@ -10,6 +10,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -21,6 +22,7 @@ permissions:
 
 jobs:
   build:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 414c5690f..bbcbe0eae 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -7,6 +7,7 @@ on:
     # Weekly ccache reseed; also keeps caches from 7-day eviction
     - cron: '0 6 * * 1'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -22,7 +23,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        # Exclude macOS for draft PRs due to its small pool
+        os: >-
+          ${{ (github.event_name == 'pull_request' &&
+          github.event.pull_request.draft) &&
+          fromJSON('["ubuntu-latest"]') ||
+          fromJSON('["ubuntu-latest", "macos-latest"]') }}
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
diff --git a/.github/workflows/code-coverage-refactor.yml b/.github/workflows/code-coverage-refactor.yml
index 130455fb1..a03556958 100644
--- a/.github/workflows/code-coverage-refactor.yml
+++ b/.github/workflows/code-coverage-refactor.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [ 'master', 'main', 'release/**' ]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -15,6 +16,7 @@ permissions:
 
 jobs:
   coverage:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     strategy:
diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml
index c2fc5fd54..db8a94ddd 100644
--- a/.github/workflows/code-coverage.yml
+++ b/.github/workflows/code-coverage.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [ 'master', 'main', 'release/**' ]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
 concurrency:
@@ -15,6 +16,7 @@ permissions:
 
 jobs:
   coverage:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     strategy: