diff --git a/.github/actions/finalize/action.yml b/.github/actions/finalize/action.yml
new file mode 100644
index 0000000..9688032
--- /dev/null
+++ b/.github/actions/finalize/action.yml
@@ -0,0 +1,10 @@
+# https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+name: "Finalize custom"
+description: "Custom finalize step to run during a pull request"
+runs:
+  using: "composite"
+  steps:
+    - name: Print environment
+      shell: bash
+      run: |
+        echo "Running in environment: ${environment}"
diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml
index 06d3e03..7b0e426 100644
--- a/.github/workflows/flowzone.yml
+++ b/.github/workflows/flowzone.yml
@@ -47,5 +47,9 @@ jobs:
         {
           "environment": ["test"]
         }
+      custom_finalize_matrix: >
+        {
+          "environment": ["test"]
+        }
       docker_images:
         ghcr.io/balena-io-experimental/deployable
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d002379..72bd8f7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,7 +2,19 @@ name: Deploy
 
 on:
   pull_request:
-    branches: [main, master]
+    types: [opened, synchronize, closed]
+    branches: [main, master, develop]
+  # allow external contributions to use secrets within trusted code
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches: [main, master, develop]
+  push:
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test: