diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 5859d2894..13c7e7ea6 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -5,24 +5,22 @@ on:
     types: [opened, reopened, synchronize]
     branches: [master]
 
+concurrency:
+  group: codegen-validation-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   codegen-validation:
     runs-on: ubuntu-latest
     name: Codegen Repo Validation
+    timeout-minutes: 10
     permissions:
-      contents: write
-      pull-requests: write
-      actions: read
+      contents: read
 
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
       - name: Get github app access token
         id: get_access_token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
         with:
           app-id: ${{ vars.XERO_CODEGEN_APP_ID }}
           private-key: ${{ secrets.XERO_GITHUB_APPLICATION_KEY }}
@@ -33,37 +31,31 @@ jobs:
         id: codegen_workflow
         env:
           GH_TOKEN: ${{ steps.get_access_token.outputs.token }}
+          SOURCE_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
+          SOURCE_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          BRANCH_NAME="${{ github.event.pull_request.head.sha }}"
-          OAS_REPO="${{ github.event.pull_request.head.repo.full_name }}"
-
-          # Trigger the workflow and capture the response
-          gh workflow run pr.yml \
-            --repo xero-internal/xeroapi-sdk-codegen \
-            --ref master \
-            --field oas_branch="$BRANCH_NAME" \
-            --field oas_repo="$OAS_REPO"
-
-          # Wait a moment for the run to be created
-          sleep 5
-
-          # Get the latest run ID for the workflow
-          RUN_ID=$(gh run list \
-            --repo xero-internal/xeroapi-sdk-codegen \
-            --workflow=pr.yml \
-            --limit 1 \
-            --json databaseId \
-            --jq '.[0].databaseId')
-
-          echo "run_id=$RUN_ID" >> $GITHUB_OUTPUT
-          echo "Triggered workflow run ID: $RUN_ID"
+          response=$(gh api \
+            --method POST \
+            -H "X-GitHub-Api-Version: 2026-03-10" \
+            repos/xero-internal/xeroapi-sdk-codegen/actions/workflows/pr.yml/dispatches \
+            -f ref=master \
+            -F return_run_details=true \
+            -f "inputs[oas_branch]=$SOURCE_SHA" \
+            -f "inputs[oas_repo]=$SOURCE_REPOSITORY")
+
+          run_id=$(jq -er '.workflow_run_id | select(type == "number")' <<< "$response")
+          run_url=$(jq -er '.html_url | select(type == "string")' <<< "$response")
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "Triggered codegen validation: $run_url"
 
       - name: Check status of codegen validation workflow
-        uses: Codex-/await-remote-run@v1.13.0
-        with:
-          token: ${{ steps.get_access_token.outputs.token }}
-          repo: xeroapi-sdk-codegen
-          owner: xero-internal
-          run_id: ${{ steps.codegen_workflow.outputs.run_id }}
-          run_timeout_seconds: 420 # 7 minutes
+        env:
+          GH_TOKEN: ${{ steps.get_access_token.outputs.token }}
+          RUN_ID: ${{ steps.codegen_workflow.outputs.run_id }}
+        run: >-
+          timeout --signal=TERM 420s
+          gh run watch "$RUN_ID"
+          --repo xero-internal/xeroapi-sdk-codegen
+          --exit-status
+          --interval 5