diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index db46ceeae941..c7a4eefbcdb6 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -27,7 +27,9 @@ jobs:
     # We're not actually verifying that the triggering push event was for a
     # tag, because github doesn't expose enough information to do so.
     # wheel-builder.yml currently only has push events for tags.
-    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success')
+    # The repository_owner check keeps forks from attempting a publish (or
+    # requesting OIDC tokens/attestations) if a tag is ever pushed to one.
+    if: github.repository_owner == 'pyca' && (github.event_name == 'workflow_dispatch' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success'))
     permissions:
       id-token: "write"
       attestations: "write"
diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml
index a0cb2413f251..45df58033158 100644
--- a/.github/workflows/wheel-builder.yml
+++ b/.github/workflows/wheel-builder.yml
@@ -27,6 +27,10 @@ jobs:
   sdist:
     runs-on: ubuntu-latest
     name: sdists
+    # Keep forks from running release builds on tag pushes or dispatches
+    # (pull_request runs are kept so workflow changes stay testable). All
+    # other jobs need this one, so skipping it skips the entire workflow.
+    if: github.repository_owner == 'pyca' || github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with: