diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 45513d603..c1406bec2 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -88,7 +88,7 @@ jobs:
   # database lookup with a second ignore list to maintain.
   cargo-deny:
     name: Cargo Deny
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
     runs-on: sm-standard-2
     timeout-minutes: 20
     steps:
@@ -131,7 +131,7 @@ jobs:
 
   workflow-pin-report:
     name: Workflow Pin Report
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
     runs-on: sm-standard-2
     timeout-minutes: 5
     steps:
@@ -203,7 +203,7 @@ jobs:
     # workflow produces, and until now it was only visible to whoever happened to
     # open the Actions tab. Same ci-8 mechanism coverage.yml and
     # e2e-replication-nightly.yml already use.
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/e2e-distributed.yml b/.github/workflows/e2e-distributed.yml
index b890c5d43..76ea2f061 100644
--- a/.github/workflows/e2e-distributed.yml
+++ b/.github/workflows/e2e-distributed.yml
@@ -78,6 +78,7 @@ concurrency:
 
 jobs:
   distributed:
+    if: github.repository == 'rustfs/rustfs'
     name: Distributed 4-node 4-disk e2e
     # GitHub-hosted VM: loop and tmpfs mounts work here. sm-standard-4 is an
     # ARC pod and rejects both (`mount -o loop` ENOENT, tmpfs "read-only").
@@ -200,7 +201,7 @@ jobs:
   alert-on-failure:
     name: Alert on scheduled failure
     needs: [distributed]
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/e2e-replication-nightly.yml b/.github/workflows/e2e-replication-nightly.yml
index b2f5b33ba..5fa9ac271 100644
--- a/.github/workflows/e2e-replication-nightly.yml
+++ b/.github/workflows/e2e-replication-nightly.yml
@@ -53,6 +53,7 @@ concurrency:
 
 jobs:
   repl-nightly:
+    if: github.repository == 'rustfs/rustfs'
     name: Replication e2e (nightly)
     # dual-node tests spawn two full rustfs servers each; the extra headroom
     # over the per-PR sm-standard-2 e2e job keeps the parallel process fan-out
@@ -119,6 +120,7 @@ jobs:
           if-no-files-found: ignore
 
   cluster-nightly:
+    if: github.repository == 'rustfs/rustfs'
     name: Cluster fault e2e (nightly)
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -168,6 +170,7 @@ jobs:
           if-no-files-found: warn
 
   protocols-nightly:
+    if: github.repository == 'rustfs/rustfs'
     name: Protocol e2e (nightly)
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -229,7 +232,7 @@ jobs:
     # Only scheduled runs open/append the tracking issue (backlog#1149 ci-8);
     # manual workflow_dispatch runs stay quiet so a debugging run never files a
     # spurious alert.
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/functional-chain-health.yml b/.github/workflows/functional-chain-health.yml
index 0a10202e2..75dbe62f5 100644
--- a/.github/workflows/functional-chain-health.yml
+++ b/.github/workflows/functional-chain-health.yml
@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: false
 jobs:
   collect:
+    if: github.repository == 'rustfs/rustfs'
     runs-on: smoke-testing
     timeout-minutes: 15
     steps:
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 2e6d8d7b3..55d513445 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -72,9 +72,11 @@ jobs:
   fuzz-build:
     name: Build Fuzz Harness
     if: >
-      (github.event_name == 'pull_request' && github.event.action != 'closed') ||
-      github.event_name == 'schedule' ||
-      github.event_name == 'workflow_dispatch'
+      github.repository == 'rustfs/rustfs' && (
+        (github.event_name == 'pull_request' && github.event.action != 'closed') ||
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch'
+      )
     runs-on: sm-standard-4
     timeout-minutes: 60
     env:
@@ -239,7 +241,7 @@ jobs:
     # `always()` is required: without it this job is skipped when a needed
     # job fails. Alerts only for scheduled (nightly) runs (backlog#1149
     # ci-8); PR and manual dispatch failures are already watched by a human.
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/nightly-gnu.yml b/.github/workflows/nightly-gnu.yml
index 739033ddb..afbbb210c 100644
--- a/.github/workflows/nightly-gnu.yml
+++ b/.github/workflows/nightly-gnu.yml
@@ -43,6 +43,7 @@ env:
 
 jobs:
   resolve-source:
+    if: github.repository == 'rustfs/rustfs'
     name: Resolve nightly source
     runs-on: sm-standard-2
     timeout-minutes: 10
@@ -496,8 +497,10 @@ jobs:
     name: Alert on scheduled failure
     needs: [build, kms-vault-lane, kms-vault-ha-failover]
     if: >-
-      always() && github.event_name == 'schedule' &&
-      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
+      github.repository == 'rustfs/rustfs' && (
+        always() && github.event_name == 'schedule' &&
+        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/nix-flake-update.yml b/.github/workflows/nix-flake-update.yml
index de674d446..06e22797b 100644
--- a/.github/workflows/nix-flake-update.yml
+++ b/.github/workflows/nix-flake-update.yml
@@ -32,6 +32,7 @@ concurrency:
 
 jobs:
   update-flake:
+    if: github.repository == 'rustfs/rustfs'
     name: Update flake.lock
     runs-on: sm-standard-2
     timeout-minutes: 90
diff --git a/.github/workflows/performance-ab.yml b/.github/workflows/performance-ab.yml
index d402ca636..aa1ddb528 100644
--- a/.github/workflows/performance-ab.yml
+++ b/.github/workflows/performance-ab.yml
@@ -49,6 +49,7 @@ env:
 
 jobs:
   warp-ab:
+    if: github.repository == 'rustfs/rustfs'
     name: Warp A/B budget gate
     runs-on: sm-standard-2
     # A normal nightly restores the last successful binary and builds only the
@@ -364,8 +365,10 @@ jobs:
     # composite action already reports cancelled/timed-out jobs in the issue
     # body.
     if: >-
-      always() && github.event_name == 'schedule' &&
-      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
+      github.repository == 'rustfs/rustfs' && (
+        always() && github.event_name == 'schedule' &&
+        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/runner-hygiene.yml b/.github/workflows/runner-hygiene.yml
index 06c73e030..2bfcc09d8 100644
--- a/.github/workflows/runner-hygiene.yml
+++ b/.github/workflows/runner-hygiene.yml
@@ -42,6 +42,7 @@ concurrency:
 
 jobs:
   check-ephemerality:
+    if: github.repository == 'rustfs/rustfs'
     name: Check runner ephemerality
     runs-on: sm-standard-2
     timeout-minutes: 15
@@ -65,7 +66,7 @@ jobs:
     # Same ci-8 mechanism as coverage.yml, audit.yml and the nightly lanes:
     # scheduled runs file a tracking issue, manual dispatch stays quiet so
     # debugging never produces a spurious alert.
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/scheduled-validation-freshness.yml b/.github/workflows/scheduled-validation-freshness.yml
index cf9a99d47..8264ad962 100644
--- a/.github/workflows/scheduled-validation-freshness.yml
+++ b/.github/workflows/scheduled-validation-freshness.yml
@@ -28,6 +28,7 @@ concurrency:
 
 jobs:
   check-freshness:
+    if: github.repository == 'rustfs/rustfs'
     name: Check scheduled validation freshness
     # Stay on GitHub-hosted runners: this monitor must keep running when the
     # self-hosted sm-standard-* pool is down, which is exactly when the
diff --git a/.github/workflows/scheduled-validation-watchdog.yml b/.github/workflows/scheduled-validation-watchdog.yml
index e0092be92..9235dcc18 100644
--- a/.github/workflows/scheduled-validation-watchdog.yml
+++ b/.github/workflows/scheduled-validation-watchdog.yml
@@ -39,6 +39,7 @@ jobs:
   alert-on-incomplete-run:
     name: Alert on incomplete scheduled run
     if: >-
+      github.repository == 'rustfs/rustfs' &&
       github.event.workflow_run.event == 'schedule' &&
       github.event.workflow_run.conclusion != 'success' &&
       github.event.workflow_run.conclusion != 'failure'
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index f719227e9..f25e696d9 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -26,6 +26,7 @@ on:
 
 jobs:
   stale:
+    if: github.repository == 'rustfs/rustfs'
     runs-on: sm-standard-2
     timeout-minutes: 30
     steps:
diff --git a/.github/workflows/star-history.yml b/.github/workflows/star-history.yml
index 3debd4017..e7880bc96 100644
--- a/.github/workflows/star-history.yml
+++ b/.github/workflows/star-history.yml
@@ -14,6 +14,7 @@ concurrency:
 
 jobs:
   update:
+    if: github.repository == 'rustfs/rustfs'
     runs-on: sm-standard-2
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/targets-integration.yml b/.github/workflows/targets-integration.yml
index 0e0255a9d..6a0d8ac20 100644
--- a/.github/workflows/targets-integration.yml
+++ b/.github/workflows/targets-integration.yml
@@ -40,6 +40,7 @@ env:
 
 jobs:
   targets-live:
+    if: github.repository == 'rustfs/rustfs'
     name: PostgreSQL, MySQL, AMQP, and NATS
     runs-on: sm-standard-2
     timeout-minutes: 90
@@ -175,8 +176,10 @@ jobs:
     name: Alert on scheduled failure
     needs: [targets-live]
     if: >-
-      always() && github.event_name == 'schedule' &&
-      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
+      github.repository == 'rustfs/rustfs' && (
+        always() && github.event_name == 'schedule' &&
+        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions: