diff --git a/.github/scripts/manylinux_build_and_test.sh b/.github/scripts/manylinux_build_and_test.sh
index ce8301a..caedc5e 100644
--- a/.github/scripts/manylinux_build_and_test.sh
+++ b/.github/scripts/manylinux_build_and_test.sh
@@ -25,6 +25,26 @@ case "$MANYLINUX_IMAGE" in
     yum install -y perl-core
     ;;
 esac
+# libiconv >= 1.19 needs GNU make >= 4.0 (po/Makefile uses '!='); CentOS 7 ships 3.82.
+case "$MANYLINUX_IMAGE" in
+  manylinux2014_*)
+    yum install -y devtoolset-10-make
+    make --version | head -n 1
+    ;;
+esac
+
+# Step: Build lxml from source with static deps (temporary)
+# TODO: remove once lxml publishes cp315 manylinux2014_x86_64 wheels.
+echo "== [container] Step: Configure lxml static build (cp315 manylinux2014 only) =="
+case "$PY_ABI/$MANYLINUX_IMAGE" in
+  cp315-*/manylinux2014_*)
+    export STATIC_DEPS=true
+    export LIBXML2_VERSION="${LIBXML2_VERSION:?}" LIBXSLT_VERSION="${LIBXSLT_VERSION:?}"
+    # lxml links its static deps into a shared extension, so they need -fPIC.
+    export CFLAGS="${CFLAGS:+$CFLAGS }-fPIC"
+    echo "STATIC_DEPS=$STATIC_DEPS LIBXML2_VERSION=$LIBXML2_VERSION LIBXSLT_VERSION=$LIBXSLT_VERSION CFLAGS=$CFLAGS"
+    ;;
+esac
 
 # Step: Install python build dependencies
 echo "== [container] Step: Install python build dependencies =="
diff --git a/.github/workflows/linuxbrew.yml b/.github/workflows/linuxbrew.yml
index 4f48bef..5bdacd0 100644
--- a/.github/workflows/linuxbrew.yml
+++ b/.github/workflows/linuxbrew.yml
@@ -1,5 +1,8 @@
 name: linuxbrew
-on: [push, pull_request]
+on:
+  push:
+    branches: [master]
+  pull_request:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref_name != 'master' }}
diff --git a/.github/workflows/macosx.yml b/.github/workflows/macosx.yml
index 503a029..43cbb56 100644
--- a/.github/workflows/macosx.yml
+++ b/.github/workflows/macosx.yml
@@ -1,5 +1,8 @@
 name: macOS
-on: [push, pull_request]
+on:
+  push:
+    branches: [master]
+  pull_request:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref_name != 'master' }}
diff --git a/.github/workflows/manylinux.yml b/.github/workflows/manylinux.yml
index 52619c6..36bd2ac 100644
--- a/.github/workflows/manylinux.yml
+++ b/.github/workflows/manylinux.yml
@@ -1,5 +1,8 @@
 name: manylinux
-on: [push, pull_request]
+on:
+  push:
+    branches: [master]
+  pull_request:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref_name != 'master' }}
@@ -61,6 +64,8 @@ jobs:
             -e PYXMLSEC_STATIC_DEPS \
             -e PY_ABI \
             -e MANYLINUX_IMAGE \
+            -e LIBXML2_VERSION \
+            -e LIBXSLT_VERSION \
             -e HOST_UID="$(id -u)" \
             -e HOST_GID="$(id -g)" \
             "quay.io/pypa/${MANYLINUX_IMAGE}" \
diff --git a/.github/workflows/sdist.yml b/.github/workflows/sdist.yml
index e20c45a..cf2284b 100644
--- a/.github/workflows/sdist.yml
+++ b/.github/workflows/sdist.yml
@@ -1,5 +1,8 @@
 name: sdist
-on: [push, pull_request]
+on:
+  push:
+    branches: [master]
+  pull_request:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref_name != 'master' }}
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index a9a2750..b4a1177 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -12,6 +12,7 @@ on:
   #        │  │ │ │ │
   - cron: "42 3 * * 4"
   push:
+    branches: [master]
   pull_request:
   workflow_dispatch: