I move one workflow off the trigger, with the same verified process as my fixes: a plan first, a sandbox re-test, and AI disclosure in the pull request. If a workflow must keep the trigger, you get a short written review instead; changing your Actions policy stays your decision.