diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ef8e953b9..72b67a77a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,9 +5,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/**']
   pull_request:
-    branches: [main]
+    branches: [main, 'release/**']
 
 permissions:
   pull-requests: write
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9cdd02912..c6b7c249e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,9 +2,9 @@ name: 'CodeQL'
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'release/**']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'release/**']
   schedule:
     - cron: '25 10 * * 1'
 
diff --git a/.github/workflows/cve.yml b/.github/workflows/cve.yml
index d40a4c486..dd2b46f55 100644
--- a/.github/workflows/cve.yml
+++ b/.github/workflows/cve.yml
@@ -5,9 +5,9 @@ permissions:
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'release/**']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'release/**']
   schedule:
     - cron: '0 6 * * 1' # Weekly Monday 6am UTC
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d12c89bad..23bec0f66 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -7,7 +7,7 @@ permissions:
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/**']
   pull_request:
   workflow_dispatch:
 
diff --git a/.github/workflows/package-smoke-test.yml b/.github/workflows/package-smoke-test.yml
index ce931d5c5..a539b7b22 100644
--- a/.github/workflows/package-smoke-test.yml
+++ b/.github/workflows/package-smoke-test.yml
@@ -5,9 +5,9 @@ name: Package Smoke Test
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/**']
   pull_request:
-    branches: [main]
+    branches: [main, 'release/**']
 
 permissions:
   contents: read
diff --git a/website/docs/development/releases.md b/website/docs/development/releases.md
index 9c1a3883c..aa4a68d9d 100644
--- a/website/docs/development/releases.md
+++ b/website/docs/development/releases.md
@@ -20,6 +20,8 @@ When a milestone reaches completion, we cut a `release/X.Y` branch from `main`,
 
 When a bug affecting a released version is reported, we **open a PR against the oldest supported release branch containing the bug**. After the fix is merged to that branch, we **merge it forward**. Suppose we support the following versions: `1.1`, `2.2` and `3.0`. If a bug affecting `2.2` is discovered, we first merge the fix into `2.2`. Then, we merge `2.2` into `3.0`, which ensures that all affected, supported versions inherit the bugfix. Since commit identity is preserved, a single SHA exists on all branches the fix was applied to. We can then easily audit that a particular version contains a fix by using `git merge-base --is-ancestor`.
 
+PRs and merges against `release/*` branches run the same CI checks as `main` (including unit/e2e tests, NPM package smoke tests, CodeQL, and CVE scanning).
+
 Features and changes other than bugfixes never go into a release branch. If you want a feature included in the next minor release, you should target `main` so it gets picked up in the next milestone.
 
 ## Release Planning