diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index f48f1bc92fb..5971057d83d 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -85,6 +85,9 @@ env:
 jobs:
   build:
     name: Build (${{ matrix.platform }})
+    # Upstream publishes to ghcr.io/block/buzz. A fork runs this only once it has set
+    # GHCR_IMAGE to a registry it can write to; otherwise every push would fail.
+    if: github.repository == 'block/buzz' || vars.GHCR_IMAGE != ''
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     permissions:
@@ -236,7 +239,9 @@ jobs:
 
   qualify:
     name: Qualify relay image source
-    if: github.event_name != 'pull_request'
+    # Upstream publishes to ghcr.io/block/buzz. A fork runs this only once it has set
+    # GHCR_IMAGE to a registry it can write to; otherwise every push would fail.
+    if: github.event_name != 'pull_request' && (github.repository == 'block/buzz' || vars.GHCR_IMAGE != '')
     runs-on: ubuntu-24.04
     timeout-minutes: 70
     permissions:
@@ -494,6 +499,9 @@ jobs:
 
   push-gateway-build:
     name: Build public push gateway (${{ matrix.platform }})
+    # Upstream publishes to ghcr.io/block/buzz. A fork runs this only once it has set
+    # GHCR_IMAGE to a registry it can write to; otherwise every push would fail.
+    if: github.repository == 'block/buzz' || vars.GHCR_IMAGE != ''
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     permissions: