diff --git a/.github/workflows/helmcharts.yml b/.github/workflows/helmcharts.yml
index 019e4b0e15..9e0308ec72 100644
--- a/.github/workflows/helmcharts.yml
+++ b/.github/workflows/helmcharts.yml
@@ -25,7 +25,7 @@ jobs:
         id: chart-version
         env:
           EVENT_NAME: ${{ github.event_name }}
-          INPUT_CHART_TAG: ${{ inputs.chart_tag || '' }}
+          INPUT_CHART_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.chart_tag || '' }}
           REF_NAME: ${{ github.ref_name }}
         run: |
           set -euo pipefail
@@ -41,9 +41,11 @@ jobs:
             exit 1
           fi
 
-          printf 'CHART_REF=refs/tags/%s\n' "$CHART_TAG" >> "$GITHUB_OUTPUT"
-          printf 'CHART_TAG=%s\n' "$CHART_TAG" >> "$GITHUB_OUTPUT"
-          printf 'CHART_VERSION=%s\n' "$CHART_VERSION" >> "$GITHUB_OUTPUT"
+          {
+            printf 'CHART_REF=refs/tags/%s\n' "$CHART_TAG"
+            printf 'CHART_TAG=%s\n' "$CHART_TAG"
+            printf 'CHART_VERSION=%s\n' "$CHART_VERSION"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/sync-helm-chart-tags.yml b/.github/workflows/sync-helm-chart-tags.yml
index fe3b5e28d1..e029a256c1 100644
--- a/.github/workflows/sync-helm-chart-tags.yml
+++ b/.github/workflows/sync-helm-chart-tags.yml
@@ -12,19 +12,30 @@ on:
         type: string
 
 permissions:
-  actions: write
-  contents: write
+  contents: read
 
 concurrency:
   group: sync-helm-chart-tags
   cancel-in-progress: false
 
 jobs:
+  noop:
+    name: Ignore non-main push
+    if: github.event_name == 'push' && github.ref != 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - name: Skip tag sync
+        run: echo "Helm chart tag sync only runs on main pushes or manual dispatch."
+
   sync:
     name: Sync chart tags
-    if: github.ref == 'refs/heads/main'
+    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      actions: write
+      contents: write
     env:
       BASE_REF: refs/remotes/origin/main
       BACKFILL_FROM_VERSION: 1.9.0
@@ -34,8 +45,8 @@ jobs:
       GITHUB_SERVER_URL: ${{ github.server_url }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GITHUB_REPOSITORY: ${{ github.repository }}
-      RELEASE_EXISTING_TAG: ${{ inputs.release_existing_tag || '' }}
-      REPO_DIR: ${{ runner.temp }}/librechat
+      RELEASE_EXISTING_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_existing_tag || '' }}
+      REPO_DIR: /tmp/librechat-sync
       TAG_PREFIX: chart-
     steps:
       - name: Fetch main and tags