diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 9f7f1d2..c245d21 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -37,6 +37,7 @@ jobs:
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
+        if: ${{ github.repository_owner == 'clux' }}
         with:
           username: clux
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -97,6 +98,7 @@ jobs:
 
       - name: Tag and push
         shell: bash
+        if: ${{ github.repository_owner == 'clux' }}
         run: |
           RUST_DATE=$(cat /tmp/tags/rust-date)
           RUST_CHANNEL=$(cat /tmp/tags/rust-channel)
@@ -118,6 +120,7 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'clux'
     needs:
       - build
     steps:
diff --git a/.github/workflows/stable.yml b/.github/workflows/stable.yml
index cf2fee3..849b59e 100644
--- a/.github/workflows/stable.yml
+++ b/.github/workflows/stable.yml
@@ -58,6 +58,7 @@ jobs:
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
+        if: ${{ github.repository_owner == 'clux' }}
         with:
           username: clux
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -112,6 +113,7 @@ jobs:
           echo $RUST_VER > /tmp/tags/rust-ver
 
       - name: Tag and push
+        if: ${{ github.repository_owner == 'clux' }}
         shell: bash
         run: |
           RUST_DATE=$(cat /tmp/tags/rust-date)
@@ -125,6 +127,7 @@ jobs:
 
       # TODO: want to do this, but need digest, which might not be trivial to get outside build-push-action
       # - name: Attest docker.io
+      #   if: ${{ github.repository_owner == 'clux' }}
       #   uses: actions/attest-build-provenance@v2.3.0
       #   with:
       #     subject-name: docker.io/${{ env.REGISTRY_IMAGE }}
@@ -143,6 +146,7 @@ jobs:
   merge:
     name: 'Stable merge'
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'clux'
     needs:
       - build
     steps: