diff --git a/.github/workflows/build-relocatable-packages.yml b/.github/workflows/build-relocatable-packages.yml
index af90b46..8a139f0 100644
--- a/.github/workflows/build-relocatable-packages.yml
+++ b/.github/workflows/build-relocatable-packages.yml
@@ -2,9 +2,9 @@ name: Build Relocatable Packages
 
 on:
   push:
-    branches: [develop, mainline, 'release/**', candidate]
+    branches: [candidate, develop, mainline, 'release/**']
   pull_request:
-    branches: [develop, mainline]
+    branches: [candidate, develop, mainline]
   schedule:
     # Daily at 13:00 UTC (5:00 AM PST)
     - cron: '0 13 * * *'
@@ -74,7 +74,8 @@ jobs:
             dpkg-deb -c "${deb}" | head -50
           done
 
-      - name: Upload artifacts (always, for inspection)
+      - name: Upload artifacts
+        if: github.ref_name != 'candidate' && github.base_ref != 'candidate'
         uses: actions/upload-artifact@v4
         with:
           name: ubuntu-22.04-packages
@@ -84,14 +85,14 @@ jobs:
           if-no-files-found: error
 
       - name: Configure AWS credentials (OIDC)
-        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != ''
+        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
 
       - name: Upload to S3
-        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != ''
+        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
         env:
           AWS_S3_BUCKET: ${{ vars.AWS_S3_BUCKET }}
         run: |
@@ -183,7 +184,8 @@ jobs:
             rpm -qlp "${rpm}" | head -50
           done
 
-      - name: Upload artifacts (always, for inspection)
+      - name: Upload artifacts
+        if: github.ref_name != 'candidate' && github.base_ref != 'candidate'
         uses: actions/upload-artifact@v4
         with:
           name: manylinux_2_28-packages
@@ -193,20 +195,20 @@ jobs:
           if-no-files-found: error
 
       - name: Install AWS CLI
-        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != ''
+        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
         run: |
           curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscli.zip
           (cd /tmp && unzip -q awscli.zip && ./aws/install)
 
       - name: Configure AWS credentials (OIDC)
-        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != ''
+        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
 
       - name: Upload to S3
-        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != ''
+        if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
         env:
           AWS_S3_BUCKET: ${{ vars.AWS_S3_BUCKET }}
         run: |
@@ -295,6 +297,7 @@ jobs:
           cat report/build-report.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload report
+        if: github.ref_name != 'candidate' && github.base_ref != 'candidate'
         uses: actions/upload-artifact@v4
         with:
           name: build-report
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6d3ba2f..313f0de 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -3,11 +3,12 @@ name: "CodeQL Security Scanning"
 on:
   push:
     branches:
+      - candidate
       - develop
       - mainline
-      - candidate
   pull_request:
     branches:
+      - candidate
       - develop
       - mainline
   schedule: