diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 7709db0e71a..2bd85247a7d 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -1,5 +1,8 @@
 name: common
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -56,8 +59,8 @@ jobs:
           key: ${{ steps.generate_cache_key.outputs.cache_key }}
 
   spm:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
+    # Run on the main repo's scheduled jobs or pull requests and manual workflow invocations.
+    if: (github.repository == 'firebase/firebase-ios-sdk' && github.event_name == 'schedule') || contains(fromJSON('["pull_request", "workflow_dispatch"]'), github.event_name)
     needs: [spm-package-resolved]
     strategy:
       matrix: