diff --git a/.github/workflows/_codeql.yml b/.github/workflows/_codeql.yml
index 61080e3bd..0fb67bcee 100644
--- a/.github/workflows/_codeql.yml
+++ b/.github/workflows/_codeql.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
       security-events: write
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           - language: "javascript-typescript"
diff --git a/.github/workflows/_control-plane.yml b/.github/workflows/_control-plane.yml
index 64f83928f..5053d597e 100644
--- a/.github/workflows/_control-plane.yml
+++ b/.github/workflows/_control-plane.yml
@@ -17,7 +17,7 @@ jobs:
     name: ${{ matrix.image_name }}
     runs-on: ubuntu-24.04
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           - image_name: domain
diff --git a/.github/workflows/_data-plane.yml b/.github/workflows/_data-plane.yml
index ce6426611..2d179e64e 100644
--- a/.github/workflows/_data-plane.yml
+++ b/.github/workflows/_data-plane.yml
@@ -72,7 +72,7 @@ jobs:
     name: update-release-draft-${{ matrix.config_name }}
     runs-on: ubuntu-24.04
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           # mark:next-gateway-version
@@ -104,7 +104,7 @@ jobs:
       run:
         working-directory: rust
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         # TODO: Add ARM64 support
         artifact: [firezone-client-headless-windows]
@@ -166,7 +166,7 @@ jobs:
       run:
         working-directory: rust
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         # Copy input vars to matrix vars to conditionally exclude them
         image_prefix:
@@ -439,7 +439,7 @@ jobs:
     if: ${{ always() }}
     runs-on: ubuntu-24.04
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         # Copy input vars to matrix vars to conditionally exclude them
         image_prefix:
diff --git a/.github/workflows/_elixir.yml b/.github/workflows/_elixir.yml
index 0d79c4118..0ec3c5701 100644
--- a/.github/workflows/_elixir.yml
+++ b/.github/workflows/_elixir.yml
@@ -160,7 +160,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       MIX_TEST_PARTITIONS: 1
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         MIX_TEST_PARTITION: [1]
     services:
diff --git a/.github/workflows/_integration_tests.yml b/.github/workflows/_integration_tests.yml
index c8ba444ed..66e8ca141 100644
--- a/.github/workflows/_integration_tests.yml
+++ b/.github/workflows/_integration_tests.yml
@@ -98,7 +98,7 @@ jobs:
       HTTP_TEST_SERVER_TAG: ${{ inputs.http_test_server_tag }}
       FIREZONE_INC_BUF: true
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         test:
           - script: create-flow-from-icmp-error
diff --git a/.github/workflows/_kotlin.yml b/.github/workflows/_kotlin.yml
index 1b6c1568c..ddb1d8867 100644
--- a/.github/workflows/_kotlin.yml
+++ b/.github/workflows/_kotlin.yml
@@ -54,7 +54,7 @@ jobs:
     # Android SDK tools hardware accel is available only on Linux runners
     runs-on: ubuntu-24.04
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           - package-type: aab
diff --git a/.github/workflows/_rust.yml b/.github/workflows/_rust.yml
index 70078bd3a..e8f87d9a8 100644
--- a/.github/workflows/_rust.yml
+++ b/.github/workflows/_rust.yml
@@ -18,7 +18,7 @@ jobs:
   static-analysis:
     name: static-analysis-${{ matrix.runs-on }}
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         # TODO: https://github.com/rust-lang/cargo/issues/5220
         runs-on: [ubuntu-24.04, macos-14, windows-2022]
@@ -58,7 +58,7 @@ jobs:
   test:
     name: test-${{ matrix.runs-on }}
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         # TODO: https://github.com/rust-lang/cargo/issues/5220
         runs-on:
@@ -133,7 +133,7 @@ jobs:
   fuzz:
     name: fuzz
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         fuzz-target: [ip_packet]
     runs-on: ubuntu-24.04
@@ -155,7 +155,7 @@ jobs:
   headless-client:
     name: headless-client-${{ matrix.test }}-${{ matrix.runs-on }}
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           - { runs-on: windows-2022, test: token-path-windows.ps1 }
diff --git a/.github/workflows/_swift.yml b/.github/workflows/_swift.yml
index 88ccb104a..b58b796cf 100644
--- a/.github/workflows/_swift.yml
+++ b/.github/workflows/_swift.yml
@@ -33,7 +33,7 @@ jobs:
       contents: write # for attaching the build artifacts to the release
       id-token: write
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           - job_name: build-ios
diff --git a/.github/workflows/_tauri.yml b/.github/workflows/_tauri.yml
index d5a1b25f1..dbcf82759 100644
--- a/.github/workflows/_tauri.yml
+++ b/.github/workflows/_tauri.yml
@@ -53,7 +53,7 @@ jobs:
   smoke-test:
     name: gui-smoke-test-${{ matrix.runs-on }}
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         runs-on: [ubuntu-22.04, ubuntu-24.04, windows-2022, windows-2025]
     runs-on: ${{ matrix.runs-on }}
@@ -97,7 +97,7 @@ jobs:
       contents: write # for attaching the build artifacts to the release
       id-token: write
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         include:
           - runs-on: ubuntu-22.04
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eff24a997..45aee63aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -222,7 +222,7 @@ jobs:
 
   compatibility-tests:
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         client:
           - image: "ghcr.io/firezone/client"
@@ -271,7 +271,7 @@ jobs:
       RELAY_TAG: ${{ github.sha }}
       FIREZONE_INC_BUF: true
     strategy:
-      fail-fast: false
+      fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix:
         test:
           - tcp-client2server