diff --git a/.github/workflows/uxm-ci.yml b/.github/workflows/uxm-ci.yml
index 5f63ac0..40ae71f 100644
--- a/.github/workflows/uxm-ci.yml
+++ b/.github/workflows/uxm-ci.yml
@@ -10,7 +10,8 @@
 #         tools-ref: <same sha>
 #
 # Private repositories must run on the self-hosted runner: hosted minutes are
-# billed for them.
+# billed for them. On a self-hosted runner no job runs for a pull request from
+# a fork, so a stranger's code never runs on the organization's machines.
 name: uxm-ci
 
 on:
@@ -44,6 +45,7 @@ defaults:
 
 jobs:
   changes:
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || !contains(inputs.runner, 'self-hosted'))
     runs-on: ${{ fromJSON(inputs.runner) }}
     permissions:
       contents: read
@@ -77,7 +79,7 @@ jobs:
 
   build:
     needs: changes
-    if: inputs.gradle && needs.changes.outputs.code == 'true'
+    if: inputs.gradle && needs.changes.outputs.code == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || !contains(inputs.runner, 'self-hosted'))
     runs-on: ${{ fromJSON(inputs.runner) }}
     permissions:
       contents: read
@@ -102,6 +104,7 @@ jobs:
           retention-days: 7
 
   text:
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || !contains(inputs.runner, 'self-hosted'))
     runs-on: ${{ fromJSON(inputs.runner) }}
     permissions:
       contents: read
@@ -121,7 +124,7 @@ jobs:
           "$py" "$RUNNER_TEMP/uxm-tools/tools/check_text.py" .
 
   title:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || !contains(inputs.runner, 'self-hosted'))
     runs-on: ${{ fromJSON(inputs.runner) }}
     permissions:
       contents: read
@@ -140,7 +143,7 @@ jobs:
           "$py" tools/check_title.py "$TITLE" $SCOPES
 
   required:
-    if: always()
+    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || !contains(inputs.runner, 'self-hosted'))
     needs: [changes, build, text, title]
     runs-on: ${{ fromJSON(inputs.runner) }}
     permissions: {}