diff --git a/.github/workflows/open-shorebird-ci.yml b/.github/workflows/open-shorebird-ci.yml
index 7d01bc6..e22b9cf 100644
--- a/.github/workflows/open-shorebird-ci.yml
+++ b/.github/workflows/open-shorebird-ci.yml
@@ -543,7 +543,7 @@ jobs:
         run: ./scripts/sync_open_sources.sh
 
       - name: gclient sync
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         run: gclient sync --no-history
 
       - name: Generate patched Dart SDK build files
@@ -653,7 +653,7 @@ jobs:
         run: ./scripts/sync_open_sources.sh
 
       - name: gclient sync
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         run: gclient sync --no-history
 
       - name: Generate patched Dart SDK build files
@@ -776,11 +776,11 @@ jobs:
         run: ./scripts/sync_open_sources.sh
 
       - name: gclient sync
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         run: gclient sync --no-history
 
       - name: gclient sync Flutter engine deps
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         working-directory: flutter
         run: gclient sync --no-history
 
@@ -934,11 +934,11 @@ jobs:
         run: ./scripts/sync_open_sources.sh
 
       - name: gclient sync
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         run: gclient sync --no-history
 
       - name: gclient sync Flutter engine deps
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         working-directory: flutter
         run: gclient sync --no-history
 
@@ -1096,11 +1096,11 @@ jobs:
         run: ./scripts/sync_open_sources.sh
 
       - name: gclient sync
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         run: gclient sync --no-history
 
       - name: gclient sync Flutter engine deps
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         working-directory: flutter
         run: gclient sync --no-history
 
@@ -1212,11 +1212,11 @@ jobs:
         run: ./scripts/sync_open_sources.sh
 
       - name: gclient sync
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         run: gclient sync --no-history
 
       - name: gclient sync Flutter engine deps
-        if: ${{ inputs.run_gclient_sync }}
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_gclient_sync }}
         working-directory: flutter
         run: gclient sync --no-history
 
diff --git a/scripts/verify_ci_workflow.rb b/scripts/verify_ci_workflow.rb
index 2b97ba1..0469650 100755
--- a/scripts/verify_ci_workflow.rb
+++ b/scripts/verify_ci_workflow.rb
@@ -1470,6 +1470,21 @@ end
       run_text.include?('ninja --version'),
     "#{job_name} must verify depot_tools-provided build tools before heavy builds"
   )
+  gclient_sync_steps = jobs.fetch(job_name).fetch('steps', []).select do |step|
+    step.fetch('name', '').start_with?('gclient sync')
+  end
+  assert!(
+    !gclient_sync_steps.empty?,
+    "#{job_name} must run gclient sync before heavy builds"
+  )
+  gclient_sync_steps.each do |step|
+    condition = step.fetch('if', '').to_s
+    assert!(
+      condition.include?("github.event_name != 'workflow_dispatch'") &&
+        condition.include?('inputs.run_gclient_sync'),
+      "#{job_name} #{step.fetch('name')} must run on push/PR CI and allow manual run_gclient_sync opt-out"
+    )
+  end
 end
 {
   'custom-dart-sdk' => 'SDK_MIN_FREE_DISK_GB',