diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index b1e9e7f3273f..655ed98d5083 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -167,6 +167,11 @@ jobs:
     timeout-minutes: 130
     runs-on:
       labels: macOS
+    # Run on protected branches, but only on public repo
+    # Allow running if CI_MACOS_INTEL label is used
+    if: |
+      (github.ref_protected && github.repository == 'dfinity/ic') ||
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'CI_MACOS_INTEL'))
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -188,7 +193,7 @@ jobs:
           BAZEL_COMMAND: test
           BAZEL_EXTRA_ARGS: '--test_tag_filters=test_macos'
           BAZEL_STARTUP_ARGS: "--output_base /var/tmp/bazel-output/${CI_RUN_ID}"
-          BAZEL_TARGETS: "//publish/binaries:pocket-ic_bin"
+          BAZEL_TARGETS: "//rs/... //publish/binaries/..."
       - name: Upload bazel-bep
         # runs only if previous step succeeded or failed;
         # we avoid collecting artifacts of jobs that were cancelled