diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml
index 9aeaaa4d3..3e1823e47 100644
--- a/.github/workflows/keepalive.yml
+++ b/.github/workflows/keepalive.yml
@@ -12,7 +12,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: mamba-org/setup-micromamba@4b9113af4fba0e9e1124b252dd6497a419e7396d # v1.11.0
+        with:
+          environment-file: conda-lock.yml
+          environment-name: cf-scripts
+          condarc-file: autotick-bot/condarc
+
+      - name: stop me if needed
+        run: |
+          python autotick-bot/stop_me_if_needed.py
+
       - uses: gautamkrishnar/keepalive-workflow@995aec69bb3f2b45b20f4e107907992c8715086d # v2.0.8
+        if: ${{ ! env.CI_SKIP }}
         with:
           commit_message: "Ah ah ah, stayin' alive"
           committer_username: conda-forge-bot
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb0ee841d..a727cd3e3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,8 +34,13 @@ jobs:
           environment-name: cf-scripts
           condarc-file: autotick-bot/condarc
 
+      - name: stop me if needed
+        run: |
+          python autotick-bot/stop_me_if_needed.py
+
       - name: compute next version
         id: version
+        if: ${{ ! env.CI_SKIP }}
         run: |
           echo "current version: "$(git tag --sort=committerdate | tail -1)
           NEXT=$(python autotick-bot/compute_next_version.py)
@@ -44,6 +49,7 @@ jobs:
 
       - name: log into ghcr.io
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -52,6 +58,7 @@ jobs:
       - name: build docker metadata
         id: meta
         uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
+        if: ${{ ! env.CI_SKIP }}
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -62,6 +69,7 @@ jobs:
 
       - name: build and push image
         uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           context: .
           push: true
@@ -69,6 +77,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: tag and release
+        if: ${{ ! env.CI_SKIP }}
         run: |
           python autotick-bot/release.py "${{ steps.version.outputs.NEXT }}"
         env:
diff --git a/.github/workflows/relock.yml b/.github/workflows/relock.yml
index 34fdbc98e..5cabb11b6 100644
--- a/.github/workflows/relock.yml
+++ b/.github/workflows/relock.yml
@@ -15,7 +15,18 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - uses: mamba-org/setup-micromamba@4b9113af4fba0e9e1124b252dd6497a419e7396d # v1.11.0
+        with:
+          environment-file: conda-lock.yml
+          environment-name: cf-scripts
+          condarc-file: autotick-bot/condarc
+
+      - name: stop me if needed
+        run: |
+          python autotick-bot/stop_me_if_needed.py
+
       - uses: conda-incubator/relock-conda@b99e8465ac98aff5f3624060b351bb537de0cb4f # v19
+        if: ${{ ! env.CI_SKIP }}
         with:
           github-token: ${{ secrets.AUTOTICK_BOT_TOKEN }}
           automerge: true
diff --git a/.github/workflows/test-model.yml b/.github/workflows/test-model.yml
index 9748e626c..d552d94a9 100644
--- a/.github/workflows/test-model.yml
+++ b/.github/workflows/test-model.yml
@@ -30,12 +30,18 @@ jobs:
           environment-name: cf-scripts
           condarc-file: autotick-bot/condarc
 
+      - name: stop me if needed
+        run: |
+          python autotick-bot/stop_me_if_needed.py
+
       - name: configure conda, install code, and clone cf-graph
+        if: ${{ ! env.CI_SKIP }}
         run: |
           pip install --no-deps --no-build-isolation -e .
           git clone --depth=1 https://github.com/regro/cf-graph-countyfair.git cf-graph
 
       - name: conda info and env
+        if: ${{ ! env.CI_SKIP }}
         run: |
           echo "=================================================================="
           echo "=================================================================="
@@ -47,6 +53,7 @@ jobs:
           conda list
 
       - name: run pytest (model)
+        if: ${{ ! env.CI_SKIP }}
         run: |
           cd cf-graph
           # for pull requests, a failed model test should not be a failed check
diff --git a/.github/workflows/tests-reusable.yml b/.github/workflows/tests-reusable.yml
index b487229cb..c9bca647b 100644
--- a/.github/workflows/tests-reusable.yml
+++ b/.github/workflows/tests-reusable.yml
@@ -69,17 +69,24 @@ jobs:
           environment-name: cf-scripts
           condarc-file: autotick-bot/condarc
 
+      - name: stop me if needed
+        run: |
+          python autotick-bot/stop_me_if_needed.py
+
       - name: configure conda and install code
+        if: ${{ ! env.CI_SKIP }}
         run: |
           pip install --no-deps --no-build-isolation -e .
 
       - name: Set up git
+        if: ${{ ! env.CI_SKIP }}
         run: |
           git config --global user.name regro-cf-autotick-bot
           git config --global user.email 36490558+regro-cf-autotick-bot@users.noreply.github.com
           git config --global pull.rebase false
 
       - name: test versions
+        if: ${{ ! env.CI_SKIP }}
         run: |
           cd ..
           python -c "import conda_forge_tick; assert conda_forge_tick.__version__ != '0.0.0'"
@@ -98,10 +105,12 @@ jobs:
 
       - name: start MongoDB
         uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # v1.12.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           mongodb-version: "latest"
 
       - name: test mongodb is OK
+        if: ${{ ! env.CI_SKIP }}
         run: |
           python -c "from pymongo import MongoClient; import os; print(MongoClient(os.environ['MONGODB_CONNECTION_STRING']))"
         env:
@@ -109,9 +118,11 @@ jobs:
 
       - name: set up docker buildx
         uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+        if: ${{ ! env.CI_SKIP }}
 
       - name: build docker image
         uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           context: .
           push: false
@@ -120,6 +131,7 @@ jobs:
 
       - name: restore test durations
         uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57  # v4.2.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           path: .test_durations
           key: test-durations-${{ github.ref }}-${{ github.sha }}
@@ -128,6 +140,7 @@ jobs:
             test-durations-
 
       - name: run pytest
+        if: ${{ ! env.CI_SKIP }}
         run: |
           export TEST_BOT_TOKEN_VAL=unpassword
           # note: we do not use pytest-xdist (-n auto) here for now because they interfere with hiding the
@@ -157,6 +170,7 @@ jobs:
 
       - name: upload test durations
         uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           name: test-durations-${{ matrix.group }}
           path: .test_durations.${{ matrix.group }}
@@ -164,6 +178,7 @@ jobs:
 
       - name: upload coverage
         uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           name: coverage-${{ matrix.group }}
           path: .coverage
@@ -205,23 +220,31 @@ jobs:
           environment-name: cf-scripts
           condarc-file: autotick-bot/condarc
 
+      - name: stop me if needed
+        run: |
+          python autotick-bot/stop_me_if_needed.py
+
       - name: download coverage artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        if: ${{ ! env.CI_SKIP }}
         with:
           pattern: coverage-*
 
       - name: combine coverage
+        if: ${{ ! env.CI_SKIP }}
         run: |
           coverage combine coverage-*/.coverage*
           coverage xml
 
       - name: upload codecov
         uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.8
+        if: ${{ ! env.CI_SKIP }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: cache test durations
         uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           path: .test_durations
           key: test-durations-${{ github.ref }}-${{ github.sha }}
@@ -231,15 +254,18 @@ jobs:
 
       - name: download test duration artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        if: ${{ ! env.CI_SKIP }}
         with:
           pattern: test-durations-*
 
       - name: combine test durations
+        if: ${{ ! env.CI_SKIP }}
         run: |
           jq '. + input' test-durations-*/.test_durations.* > .test_durations
 
       - name: upload test durations
         uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        if: ${{ ! env.CI_SKIP }}
         with:
           name: test-durations
           path: .test_durations