diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60eb512..b0e1308 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,6 +105,16 @@ jobs:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
 
+      # Before building, so pulling the postgres base image counts against our
+      # account instead of the anonymous limit of the shared runner IP. Pull
+      # requests from forks get no secrets, so they build anonymously.
+      - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PERSONAL_KEY }}
+
       - name: Build
         uses: docker/bake-action@v6
         with:
@@ -133,13 +143,6 @@ jobs:
           path: /tmp/summary/${{ matrix.target }}
           retention-days: 1
 
-      - name: Log in to Docker Hub
-        if: env.PUBLISH == 'true'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PERSONAL_KEY }}
-
       # Same build as above (served from the builder cache), pushed untagged.
       # The publish job stitches the per-arch digests into tagged manifests.
       - name: Push by digest