diff --git a/src/main/java/org/eclipsefoundation/git/eca/helper/GithubValidationHelper.java b/src/main/java/org/eclipsefoundation/git/eca/helper/GithubValidationHelper.java
index 6fa08c4c4554e6a0809fd6c37a9388f7d5b079aa..735fd15a883d37b1f7aee803a18100da7a253b37 100644
--- a/src/main/java/org/eclipsefoundation/git/eca/helper/GithubValidationHelper.java
+++ b/src/main/java/org/eclipsefoundation/git/eca/helper/GithubValidationHelper.java
@@ -218,26 +218,24 @@ public class GithubValidationHelper {
      * @return true if the validation passed, false otherwise.
      */
     public ValidationResponse handleGithubWebhookValidation(GithubWebhookRequest request, ValidationRequest vr, RequestWrapper wrapper) {
+        // null check the pull request to make sure that someone didn't push a bad value
+        PullRequest pr = request.getPullRequest();
+        if (pr == null) {
+            throw new IllegalStateException("Pull request should not be null when handling validation");
+        }
+
         // update the status before processing
-        LOGGER
-                .trace(VALIDATION_LOGGING_MESSAGE, request.getRepository().getFullName(), request.getPullRequest().getNumber(),
-                        GithubCommitStatuses.PENDING);
+        LOGGER.trace(VALIDATION_LOGGING_MESSAGE, request.getRepository().getFullName(), pr.getNumber(), GithubCommitStatuses.PENDING);
         updateCommitStatus(request, GithubCommitStatuses.PENDING);
 
         // validate the response
-        LOGGER
-                .trace("Begining validation of request for {}/#{}", request.getRepository().getFullName(),
-                        request.getPullRequest().getNumber());
+        LOGGER.trace("Begining validation of request for {}/#{}", request.getRepository().getFullName(), pr.getNumber());
         ValidationResponse r = validation.validateIncomingRequest(vr, wrapper);
         if (r.getPassed()) {
-            LOGGER
-                    .trace(VALIDATION_LOGGING_MESSAGE, request.getRepository().getFullName(), request.getPullRequest().getNumber(),
-                            GithubCommitStatuses.SUCCESS);
+            LOGGER.trace(VALIDATION_LOGGING_MESSAGE, request.getRepository().getFullName(), pr.getNumber(), GithubCommitStatuses.SUCCESS);
             updateCommitStatus(request, GithubCommitStatuses.SUCCESS);
         } else {
-            LOGGER
-                    .trace(VALIDATION_LOGGING_MESSAGE, request.getRepository().getFullName(), request.getPullRequest().getNumber(),
-                            GithubCommitStatuses.FAILURE);
+            LOGGER.trace(VALIDATION_LOGGING_MESSAGE, request.getRepository().getFullName(), pr.getNumber(), GithubCommitStatuses.FAILURE);
             updateCommitStatus(request, GithubCommitStatuses.FAILURE);
         }
         return r;
@@ -275,12 +273,10 @@ public class GithubValidationHelper {
         GithubWebhookTracking updatedTracking;
         if (tracking.isEmpty()) {
             updatedTracking = new GithubWebhookTracking();
-            updatedTracking.setHeadSha(request.getHead().getSha());
             updatedTracking.setInstallationId(installationId);
             updatedTracking.setLastUpdated(DateTimeHelper.now());
             updatedTracking.setPullRequestNumber(request.getNumber());
             updatedTracking.setRepositoryFullName(sanitizedRepoName);
-            updatedTracking.setLastKnownState(request.getState());
             updatedTracking.setNeedsRevalidation(false);
             updatedTracking.setManualRevalidationCount(0);
             if (!"open".equalsIgnoreCase(request.getState())) {
@@ -289,10 +285,12 @@ public class GithubValidationHelper {
                                 updatedTracking.getPullRequestNumber(), sanitizedRepoName);
             }
         } else {
-            // at least update the state on every run
+            // uses the DB version as a base if available
             updatedTracking = tracking.get();
-            updatedTracking.setLastKnownState(request.getState());
         }
+        // always update the head SHA and the last known state
+        updatedTracking.setLastKnownState(request.getState());
+        updatedTracking.setHeadSha(request.getHead().getSha());
 
         // save the data, and log on its success or failure
         List<GithubWebhookTracking> savedTracking = dao
@@ -342,18 +340,24 @@ public class GithubValidationHelper {
      * @param fingerprint the internal unique string for the set of commits being processed
      */
     private void updateCommitStatus(GithubWebhookRequest request, GithubCommitStatuses state) {
+        PullRequest pr = request.getPullRequest();
+        if (pr == null) {
+            // should not be reachable, but for safety
+            throw new IllegalStateException("Pull request should not be null when handling validation");
+        }
+
         LOGGER
                 .trace("Generated access token for installation {}: {}", request.getInstallation().getId(),
                         jwtHelper.getGithubAccessToken(request.getInstallation().getId()).getToken());
         ghApi
                 .updateStatus(jwtHelper.getGhBearerString(request.getInstallation().getId()), apiVersion,
-                        request.getRepository().getFullName(), request.getPullRequest().getHead().getSha(),
+                        request.getRepository().getFullName(), pr.getHead().getSha(),
                         GithubCommitStatusRequest
                                 .builder()
                                 .setDescription(state.getMessage())
                                 .setState(state.toString())
                                 .setTargetUrl(webhooksConfig.github().serverTarget() + "/git/eca/status/gh/"
-                                        + request.getRepository().getFullName() + '/' + request.getPullRequest().getNumber())
+                                        + request.getRepository().getFullName() + '/' + pr.getNumber())
                                 .setContext(webhooksConfig.github().context())
                                 .build());
     }