diff --git a/.github/shared-actions/check-pr-up-to-date/action.yaml b/.github/shared-actions/check-pr-up-to-date/action.yaml
new file mode 100644
index 0000000..0329070
--- /dev/null
+++ b/.github/shared-actions/check-pr-up-to-date/action.yaml
@@ -0,0 +1,33 @@
+name: Check PR is up to date with base
+description: >
+  Fails when the PR head commit is behind the given base branch.
+  Callers decide whether to run this before expensive jobs (e.g. full-test-suite).
+inputs:
+  base_ref:
+    description: Base branch name (e.g. master)
+    required: true
+  head_sha:
+    description: PR head commit SHA to check
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout PR head
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        ref: ${{ inputs.head_sha }}
+
+    - name: Fail if behind base branch
+      shell: bash
+      env:
+        BASE_REF: ${{ inputs.base_ref }}
+      run: |
+        git fetch --no-tags origin "$BASE_REF"
+        if ! git merge-base --is-ancestor "origin/$BASE_REF" HEAD; then
+          echo "::error::PR branch is behind '$BASE_REF'. Update the branch, then re-run."
+          git --no-pager log --oneline "HEAD..origin/$BASE_REF" | head -20
+          exit 1
+        fi
+        echo "PR is up to date with origin/$BASE_REF"
diff --git a/.github/workflows/full-test-suite-on-pr.yaml b/.github/workflows/full-test-suite-on-pr.yaml
new file mode 100644
index 0000000..d43017f
--- /dev/null
+++ b/.github/workflows/full-test-suite-on-pr.yaml
@@ -0,0 +1,121 @@
+name: Full Suite Test on PR (API + E2E On Venv)
+# PR entrypoint: decide whether the PR may run, then call full-test-suite.
+# full-test-suite itself only runs the suite (no PR policy).
+# Merge-queue / workflow_dispatch callers should keep using full-test-suite.yaml.
+on:
+  workflow_call:
+    inputs:
+      build_image:
+        type: boolean
+        required: false
+        description: This has no effect on this workflow any more, should be remoeved when all services will remove it
+        default: false
+      tests_tag:
+        type: string
+        required: false
+        description: Set the e2e-api tests branch tag
+        default: master
+      ref:
+        type: string
+        required: false
+        description: Set the venv branch
+        default: ''
+      react_version:
+        type: string
+        required: false
+        description: Set the react version
+      dispatch_id:
+        type: string
+        required: false
+        description: Dispatch id to update status (repo/sha)
+    secrets:
+      GH_REPOSITORY_ADMIN_TOKEN:
+        description: 'Github repository admin token'
+        required: true
+      DEV_ARGOCD_PASSWORD:
+        description: 'ArgoCD password'
+        required: true
+      NPM_TOKEN:
+        description: 'Npm token'
+        required: true
+      DOCKER_HUB_ACTION_USER:
+        description: 'Docker hub user'
+        required: true
+      DOCKER_HUB_ACTION_PASSWORD:
+        description: 'Docker hub password'
+        required: true
+      MAILOSAUR_API_KEY:
+        description: 'MAILOSAUR API KEY'
+        required: true
+      MAILOSAUR_SERVER_ID:
+        description: 'MAILOSAUR SERVER ID'
+        required: true
+      MAILOSAUR_SERVER_DOMAIN:
+        description: 'MAILOSAUR SERVER DOMAIN'
+        required: true
+      ZEPHYR_TOKEN:
+        description: ''
+        required: true
+      AZURE_APP_CLIENT_ID:
+        description: ''
+        required: true
+      AZURE_APP_SECRET:
+        description: ''
+        required: true
+      GH_FRONTEGG_BOT_APP_ID:
+        description: 'Frontegg Bot Creds'
+        required: true
+      GH_FRONTEGG_BOT_APP_SECRET:
+        description: 'Frontegg Bot Creds'
+        required: true
+      DD_API_KEY:
+        description: 'Datadog API Key'
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+  issues: read
+  checks: write
+  statuses: write
+  pull-requests: write
+
+jobs:
+  check-up-to-date:
+    name: Check PR is up to date with base
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout PR head
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Fail if behind base branch
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git fetch --no-tags origin "$BASE_REF"
+          if ! git merge-base --is-ancestor "origin/$BASE_REF" HEAD; then
+            echo "::error::PR branch is behind '$BASE_REF'. Update the branch, then re-run e2e."
+            git --no-pager log --oneline "HEAD..origin/$BASE_REF" | head -20
+            exit 1
+          fi
+          echo "PR is up to date with origin/$BASE_REF"
+
+  run-full-test:
+    name: Run full test suite
+    needs: [ check-up-to-date ]
+    if: |
+      always() &&
+      !cancelled() &&
+      (needs.check-up-to-date.result == 'success' || needs.check-up-to-date.result == 'skipped')
+    uses: frontegg/workflows/.github/workflows/full-test-suite.yaml@master
+    with:
+      build_image: ${{ inputs.build_image }}
+      tests_tag: ${{ inputs.tests_tag }}
+      ref: ${{ inputs.ref }}
+      react_version: ${{ inputs.react_version }}
+      dispatch_id: ${{ inputs.dispatch_id }}
+    secrets: inherit