diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index ee10bd258..5bee55a24 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -1,17 +1,32 @@
 name: PR Test operator
 
 on:
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: 
     - main
     - rhdh-1.[0-9]+
     - 1.[0-9]+.x
     - release-1.[0-9]+
 jobs:
+  authorize:
+    # The 'external' environment is configured with the odo-maintainers team as required reviewers.
+    # All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks.
+    # see list of approvers in OWNERS file
+    environment:
+      ${{ (github.event.pull_request.head.repo.full_name == github.repository ||
+        contains(fromJSON('["gazarenkov","nickboldt","rm3l","openshift-cherrypick-robot"]'), github.actor)) && 'internal' || 'external' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: approved
+        run: |
+          echo "✓"
+
   pr-validate:
     name: PR Validate
     runs-on: ubuntu-latest
-    steps:
+    needs: authorize
+    steps:          
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
@@ -48,6 +63,9 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Store build timestamp
+        run: echo "BUILD_TIME=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
+
       # gosec needs a "build" stage so connect it to the lint step which we always do
       - name: Build
         run: make lint
@@ -67,6 +85,55 @@ jobs:
           make manifests generate fmt vet install
           make run &
 
+      - name: Write SeaLights token into file
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: echo "${SEALIGHTS_AGENT_TOKEN}" > sltoken.txt
+        env:
+          SEALIGHTS_AGENT_TOKEN: '${{secrets.SEALIGHTS_AGENT_TOKEN}}' ## Make sure to add token to repo secrets
+
+      - name: Download SeaLights Go agent and CLI tool
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+            echo "[SeaLights] Downloading SeaLights Golang & CLI Agents..."
+            # Architectures available: darwin-amd64, darwin-arm64, linux-amd64, linux-arm64
+            SL_OS_ARCH=linux-amd64
+            SL_GO_AGENT_VERSION=v1.1.193
+            SL_CLI_AGENT_VERSION=v1.0.49
+            wget -nv -O sealights-go-agent.tar.gz https://agents.sealights.co/slgoagent/${SL_GO_AGENT_VERSION}/slgoagent-${SL_OS_ARCH}.tar.gz
+            wget -nv -O sealights-slcli.tar.gz https://agents.sealights.co/slcli/${SL_CLI_AGENT_VERSION}/slcli-${SL_OS_ARCH}.tar.gz
+            tar -xzf ./sealights-go-agent.tar.gz && tar -xzf ./sealights-slcli.tar.gz 
+            rm -f ./sealights-go-agent.tar.gz ./sealights-slcli.tar.gz 
+            ./slgoagent -v 2> /dev/null | grep version && ./slcli -v 2> /dev/null | grep version
+
+      - name: Initiating the SeaLights agent
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "[SeaLights] Initiating the SeaLights agent to Golang and handing it the token"
+          ./slcli config init --lang go --token ./sltoken.txt
+
+      - name: Configuring SeaLights
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "[SeaLights] Configuring SeaLights to scan the pull request branch"
+          echo "Latest commit sha: ${LATEST_COMMIT_SHA}"
+          echo "PR Number: ${PULL_REQUEST_NUMBER}"
+          echo "Target Branch: ${TARGET_BRANCH}"
+          ./slcli config create-pr-bsid --app rhdh-operator --target-branch ${TARGET_BRANCH} --pull-request-number ${PULL_REQUEST_NUMBER} --latest-commit ${LATEST_COMMIT_SHA} --repository-url https://github.com/redhat-developer/rhdh-operator.git
+        env:
+          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
+          LATEST_COMMIT_SHA: ${{github.event.pull_request.head.sha}}
+           ${{ github.ref_name }}
+          TARGET_BRANCH: ${{ github.base_ref }}
+
+      - name: Run SeaLights scan for unit and integration tests
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "[SeaLights] Running the SeaLights integration tests scan"
+          ./slcli scan --bsid buildSessionId.txt  --path-to-scanner ./slgoagent --workspacepath "./" --scm git --scmBaseUrl https://github.com/redhat-developer/rhdh-operator --scmProvider github
+        env:
+          SEALIGHTS_TEST_STAGE: "Unit and Integration"
+          SEALIGHTS_TEST_SELECTION: false
+
       - name: Test
         # run this stage only if there are changes that match the includes and not the excludes
         if: steps.changed-files.outputs.any_changed == 'true'
@@ -83,6 +150,12 @@ jobs:
         if: steps.changed-files.outputs.any_changed == 'true'
         run: make integration-test ARGS='--focus "create default rhdh"' USE_EXISTING_CLUSTER=true USE_EXISTING_CONTROLLER=true
 
+      - name: Remove SeaLights secrets
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "[SeaLights] Cleaning up after SeaLights run"
+          rm -f sltoken.txt
+          
       - name: Run Gosec Security Scanner
         run: make gosec
 
@@ -90,4 +163,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3
         with:
           # Path to SARIF file relative to the root of the repository
-          sarif_file: gosec.sarif
+          sarif_file: gosec.sarif
\ No newline at end of file