diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1324e5d3a..5b8267ae2c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,11 +115,10 @@ jobs:
             cflags: "-DASAN=1 -DRZ_ASSERT_STDOUT=1 -ftrivial-auto-var-init=pattern -funsigned-char"
             meson_options: -Dbuildtype=debug -Db_sanitize=leak --werror
             asan: true
-            enable: ${{ github.event_name == 'pull_request' }}
             lsan_options: log_path=/tmp/lsan_logs/log
             continue-on-error: false
             run_tests: true
-            enabled: ${{ needs.changes.outputs.edited == 'true' }}
+            enabled: ${{ (needs.changes.outputs.edited == 'true' || github.event_name == 'pull_request') }}
             timeout: 120
             # The existing leaks in Rizin will make the tests fail otherwise
             # before it runs the script to check for new leaks.
@@ -363,7 +362,7 @@ jobs:
           LSAN_OPTIONS: ${{ matrix.lsan_options }}
           CC: ${{ matrix.compiler }}
       - name: Check for new leaks
-        if: matrix.lsan_options != ''
+        if: matrix.lsan_options != '' && matrix.enabled
         run: |
           ./sys/lsan_check.py ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} /tmp/lsan_logs/*
       - name: Generate coverage data
diff --git a/sys/lsan_check.py b/sys/lsan_check.py
index 76a59bf6b3..737b7798d4 100755
--- a/sys/lsan_check.py
+++ b/sys/lsan_check.py
@@ -18,6 +18,14 @@ def get_changed_lines(
     """
     changed: Dict[Path, List[Tuple[int, int]]] = {}
 
+    try:
+        subprocess.check_call(["git", "rev-parse", "--verify", f"{base_ref}"])
+        subprocess.check_call(["git", "rev-parse", "--verify", f"{head_ref}"])
+    except subprocess.CalledProcessError:
+        # References were malformed.
+        print(f"One or both references are invalid: {base_ref} and {head_ref}")
+        sys.exit(1)
+
     # --unified=0  gives hunks like “@@ -L,C +L,C @@”  (we care about the + side)
     cmd = ["git", "diff", "--unified=0", f"{base_ref}..{head_ref}"]
     out = subprocess.check_output(cmd, text=True, stderr=subprocess.DEVNULL)