diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8514af..7a36326 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,9 @@ permissions:
 
 jobs:
   test:
+    if: >-
+      !github.event.pull_request ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-26.04
     env:
       GOTOOLCHAIN: local
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 33c999d..f459d5e 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -26,6 +26,9 @@ defaults:
 
 jobs:
   publish:
+    if: >-
+      !github.event.pull_request ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-26.04
     environment: docker-publish
     timeout-minutes: 15
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index bc9f6c3..fa26d2c 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -29,6 +29,9 @@ defaults:
 
 jobs:
   build:
+    if: >-
+      !github.event.pull_request ||
+      github.event.pull_request.head.repo.full_name == github.repository
     name: Linux ${{ matrix.arch }}
     outputs:
       version: ${{ steps.metadata.outputs.version }}