diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index addeb36d0a178..fc21bb7397cb5 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -230,11 +230,14 @@ jobs:
   # Runs on-host integration and unit tests.
   on-device-test:
     needs: [initialize, build]
-    if: |  # Always run if not a PR or if the PR has on_device label
-      fromJSON(needs.initialize.outputs.on_device_test).enabled == true && (
-        github.event_name != 'pull_request' ||
+    # Run if PR has on_device label, and on postsubmit and nightlies if
+    # repositories variables permit.
+    if: |
+      fromJSON(needs.initialize.outputs.on_device_test).enabled == true && ((
+        github.event_name == 'pull_request' &&
         contains(github.event.pull_request.labels.*.name, 'on_device')
-      )
+      ) || ( ${{ inputs.nightly == 'true' && vars.RUN_ODT_TESTS_ON_NIGHTLY != 'False' ) }} ||
+      ${{ ( github.event_name == 'push' && env.RUN_ODT_TESTS_ON_POSTSUBMIT != 'False' ) }} )
     runs-on: [self-hosted, linux, X64]
     name: ${{ matrix.name }}_on_device_${{ matrix.shard }}
     container: ${{ needs.docker-unittest-image.outputs.docker_unittest_tag }}