diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml
index 04e77f00a..4b8aa8383 100644
--- a/.github/workflows/github-actions.yml
+++ b/.github/workflows/github-actions.yml
@@ -1,4 +1,13 @@
-on: [push]
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   openapi-spec-build:
     runs-on: ubuntu-latest
@@ -6,11 +15,26 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - &configure-aws
+        name: Configure AWS credentials for Docker Hub secrets (OIDC)
+        if: github.event_name != 'pull_request'
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-hellosign-openapi-branch-main
+          aws-region: us-west-2
+
+      - &get-docker-secrets
+        name: Get Docker Hub secrets from AWS Secrets Manager
+        if: github.event_name != 'pull_request'
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        with:
+          secret-ids: |
+            DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
+            DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
+          parse-json-secrets: false
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status oas
@@ -21,17 +45,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build PHP SDK
         run: ./generate-sdks -t php
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status php
@@ -42,17 +63,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Python SDK
         run: ./generate-sdks -t python
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status python
@@ -63,17 +81,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Ruby SDK
         run: ./generate-sdks -t ruby
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status ruby
@@ -84,17 +99,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build NodeJs SDK
         run: ./generate-sdks -t node
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status node
@@ -105,17 +117,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Java SDK
         run: ./generate-sdks -t java-v1
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status java-v1
@@ -126,17 +135,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Java SDK
         run: ./generate-sdks -t java-v2
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status java-v2
@@ -147,17 +153,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build DotNet SDK
         run: ./generate-sdks -t dotnet
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status dotnet
diff --git a/bin/php b/bin/php
index e0aa3ee10..3db44cde0 100755
--- a/bin/php
+++ b/bin/php
@@ -8,7 +8,7 @@ DIR=$(cd `dirname $0` && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/openapi"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/dotnet/run-build b/sdks/dotnet/run-build
index d65fff536..c4dff86f5 100755
--- a/sdks/dotnet/run-build
+++ b/sdks/dotnet/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/dotnet"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/java-v1/run-build b/sdks/java-v1/run-build
index 99e100a84..2262ad532 100755
--- a/sdks/java-v1/run-build
+++ b/sdks/java-v1/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/java"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/java-v2/run-build b/sdks/java-v2/run-build
index 2831739d6..aae70c35a 100755
--- a/sdks/java-v2/run-build
+++ b/sdks/java-v2/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/java"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/node/run-build b/sdks/node/run-build
index 7a26bec0b..574cbc0da 100755
--- a/sdks/node/run-build
+++ b/sdks/node/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/javascript"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/php/run-build b/sdks/php/run-build
index e1012e02f..51a9fe1d8 100755
--- a/sdks/php/run-build
+++ b/sdks/php/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/php"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/python/run-build b/sdks/python/run-build
index 179dec428..09284e82c 100755
--- a/sdks/python/run-build
+++ b/sdks/python/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/python"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
diff --git a/sdks/ruby/run-build b/sdks/ruby/run-build
index dc37a2cd7..cecea48f1 100755
--- a/sdks/ruby/run-build
+++ b/sdks/ruby/run-build
@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/ruby"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi