diff --git a/.github/workflows/supply-chain-pr.yml b/.github/workflows/supply-chain-pr.yml
index 8cfbb7ed..80ab7ff4 100644
--- a/.github/workflows/supply-chain-pr.yml
+++ b/.github/workflows/supply-chain-pr.yml
@@ -35,10 +35,13 @@ jobs:
     name: Verify Supply Chain
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    # Run for: manual dispatch, PR builds, or any push builds from docker-build
+    # Run for: manual dispatch, direct push/PR, or successful workflow_run triggered by push/PR
     if: >
       github.event_name == 'workflow_dispatch' ||
-      ((github.event.workflow_run.event == 'pull_request' || github.event.workflow_run.event == 'push') &&
+      github.event_name == 'push' ||
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'workflow_run' &&
+       (github.event.workflow_run.event == 'pull_request' || github.event.workflow_run.event == 'push') &&
        github.event.workflow_run.conclusion == 'success')
 
     steps:
diff --git a/scripts/install-go-1.25.6.sh b/scripts/install-go-1.25.7.sh
similarity index 95%
rename from scripts/install-go-1.25.6.sh
rename to scripts/install-go-1.25.7.sh
index 43d5a88c..e4ecb48b 100755
--- a/scripts/install-go-1.25.6.sh
+++ b/scripts/install-go-1.25.7.sh
@@ -2,9 +2,9 @@
 set -euo pipefail
 
 # Script to install go 1.25.7 to /usr/local/go
-# Usage: sudo ./scripts/install-go-1.25.6.sh
+# Usage: sudo ./scripts/install-go-1.25.7.sh
 
-GO_VERSION="1.25.6"
+GO_VERSION="1.25.7"
 ARCH="linux-amd64"
 TARFILE="go${GO_VERSION}.${ARCH}.tar.gz"
 TMPFILE="/tmp/${TARFILE}"