diff --git a/.github/resources/integ-service-account.json.gpg b/.github/resources/integ-service-account.json.gpg
new file mode 100644
index 000000000..e8cc3e2a2
Binary files /dev/null and b/.github/resources/integ-service-account.json.gpg differ
diff --git a/.github/scripts/run_integration_tests.sh b/.github/scripts/run_integration_tests.sh
new file mode 100755
index 000000000..060c5ba9f
--- /dev/null
+++ b/.github/scripts/run_integration_tests.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+set -u
+
+gpg --quiet --batch --yes --decrypt --passphrase="${FIREBASE_SERVICE_ACCT_KEY}" \
+  --output integ-service-account.json .github/resources/integ-service-account.json.gpg
+
+echo "${FIREBASE_API_KEY}" > integ-api-key.txt
+
+pytest integration/ --cert integ-service-account.json --apikey integ-api-key.txt
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 976767d64..5a952418c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,6 @@
 name: Continuous Integration
 
-on: [push, pull_request]
+on: push
 
 jobs:
   build:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6111dd7f1..df6183952 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,11 +15,10 @@
 name: Release
 
 on:
-  # Only run the workflow when a PR is closed, or when a developer explicitly requests
+  # Only run the workflow when a PR is updated or when a developer explicitly requests
   # a build by sending a 'firebase_build' event.
   pull_request:
-    types:
-      - closed
+    types: [opened, synchronize, closed]
 
   repository_dispatch:
     types:
@@ -27,10 +26,9 @@ on:
 
 jobs:
   stage_release:
-    # If triggered by a PR it must be merged and contain the label 'release:build'.
+    # If triggered by a PR it must contain the label 'release:build'.
     if: github.event.action == 'firebase_build' ||
-      (github.event.pull_request.merged &&
-      contains(github.event.pull_request.labels.*.name, 'release:build'))
+      contains(github.event.pull_request.labels.*.name, 'release:build')
 
     runs-on: ubuntu-latest
 
@@ -53,10 +51,14 @@ jobs:
         pip install -r requirements.txt
         pip install wheel
 
-    - name: Run tests
-      run: |
-        pytest
-        echo "Running integration tests"
+    - name: Run unit tests
+      run: pytest
+
+    - name: Run integration tests
+      run: ./.github/scripts/run_integration_tests.sh
+      env:
+        FIREBASE_SERVICE_ACCT_KEY: ${{ secrets.FIREBASE_SERVICE_ACCT_KEY }}
+        FIREBASE_API_KEY: ${{ secrets.FIREBASE_API_KEY }}
 
     - name: Package release artifacts
       run: python setup.py bdist_wheel bdist_egg
diff --git a/integration/test_db.py b/integration/test_db.py
index 7a73ea3ad..c448436d6 100644
--- a/integration/test_db.py
+++ b/integration/test_db.py
@@ -55,7 +55,7 @@ def update_rules(app):
     with open(testutils.resource_filename('dinosaurs_index.json')) as rules_file:
         new_rules = json.load(rules_file)
     client = db.reference('', app)._client
-    rules = client.body('get', '/.settings/rules.json')
+    rules = client.body('get', '/.settings/rules.json', params='format=strict')
     existing = rules.get('rules')
     if existing != new_rules:
         rules['rules'] = new_rules