diff --git a/.github/workflows/contracts-ecdsa.yml b/.github/workflows/contracts-ecdsa.yml
index fbb1c1194f..28ff0660dd 100644
--- a/.github/workflows/contracts-ecdsa.yml
+++ b/.github/workflows/contracts-ecdsa.yml
@@ -1,5 +1,9 @@
 name: Solidity ECDSA
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   schedule:
     - cron: "0 0 * * *"
@@ -41,20 +45,41 @@ jobs:
   contracts-detect-changes:
     runs-on: ubuntu-latest
     outputs:
-      path-filter: ${{ steps.filter.outputs.path-filter }}
+      path-filter: ${{ steps.set-output.outputs.path-filter }}
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout code
+        uses: actions/checkout@v3
         if: github.event_name == 'pull_request'
+        with:
+          fetch-depth: 0
 
-      - uses: dorny/paths-filter@v2
+      - name: Detect path changes
+        uses: dorny/paths-filter@v2
         if: github.event_name == 'pull_request'
         id: filter
+        continue-on-error: true
         with:
           filters: |
             path-filter:
               - './solidity/ecdsa/**'
               - './.github/workflows/contracts-ecdsa.yml'
 
+      - name: Set path-filter output
+        id: set-output
+        run: |
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            # For non-PR events, always set to true
+            echo "path-filter=true" >> $GITHUB_OUTPUT
+          else
+            # For PRs, try to use filter output, default to false if not available
+            FILTER_OUTPUT="${{ steps.filter.outputs.path-filter }}"
+            if [ -n "$FILTER_OUTPUT" ] && [ "$FILTER_OUTPUT" != "" ] && [ "$FILTER_OUTPUT" != "null" ]; then
+              echo "path-filter=$FILTER_OUTPUT" >> $GITHUB_OUTPUT
+            else
+              echo "path-filter=false" >> $GITHUB_OUTPUT
+            fi
+          fi
+
   contracts-lint:
     needs: contracts-detect-changes
     if: |
diff --git a/.github/workflows/contracts-random-beacon.yml b/.github/workflows/contracts-random-beacon.yml
index 3bd3a8147d..2af59c34f0 100644
--- a/.github/workflows/contracts-random-beacon.yml
+++ b/.github/workflows/contracts-random-beacon.yml
@@ -1,5 +1,9 @@
 name: Solidity Random Beacon
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   schedule:
     - cron: "0 0 * * *"
@@ -41,20 +45,41 @@ jobs:
   contracts-detect-changes:
     runs-on: ubuntu-latest
     outputs:
-      path-filter: ${{ steps.filter.outputs.path-filter }}
+      path-filter: ${{ steps.set-output.outputs.path-filter }}
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout code
+        uses: actions/checkout@v3
         if: github.event_name == 'pull_request'
+        with:
+          fetch-depth: 0
 
-      - uses: dorny/paths-filter@v2
+      - name: Detect path changes
+        uses: dorny/paths-filter@v2
         if: github.event_name == 'pull_request'
         id: filter
+        continue-on-error: true
         with:
           filters: |
             path-filter:
               - './solidity/random-beacon/**'
               - './.github/workflows/contracts-random-beacon.yml'
 
+      - name: Set path-filter output
+        id: set-output
+        run: |
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            # For non-PR events, always set to true
+            echo "path-filter=true" >> $GITHUB_OUTPUT
+          else
+            # For PRs, try to use filter output, default to false if not available
+            FILTER_OUTPUT="${{ steps.filter.outputs.path-filter }}"
+            if [ -n "$FILTER_OUTPUT" ] && [ "$FILTER_OUTPUT" != "" ] && [ "$FILTER_OUTPUT" != "null" ]; then
+              echo "path-filter=$FILTER_OUTPUT" >> $GITHUB_OUTPUT
+            else
+              echo "path-filter=false" >> $GITHUB_OUTPUT
+            fi
+          fi
+
   contracts-lint:
     needs: contracts-detect-changes
     if: |