diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e7d06cf..15ac304 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -45,6 +45,8 @@ jobs:
 
   publish:
     needs: ci
+    # A manual run can pick any branch; only master ever becomes :master.
+    if: github.ref == 'refs/heads/master'
     runs-on: [self-hosted, jiji-ci]
     permissions:
       contents: read