diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 57d7861..65a0577 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -6,8 +6,8 @@ on:
 
 jobs:
   enclave:
-    # Only run if the Go workflow succeeded
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # Only build successful Go runs from this repository.
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }}
     permissions:
       id-token: write # for AWS OIDC authentication
     runs-on: ubuntu-latest
diff --git a/.github/workflows/eif-build.yml b/.github/workflows/eif-build.yml
index 5597273..40fb73a 100644
--- a/.github/workflows/eif-build.yml
+++ b/.github/workflows/eif-build.yml
@@ -71,6 +71,7 @@ jobs:
     if: |
       (github.event_name == 'workflow_dispatch' ||
        (github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
         github.event.workflow_run.head_branch == 'main' &&
         !startsWith(github.event.workflow_run.head_commit.message, '[skip-build]')))
     permissions: