diff --git a/.github/workflows/bundled-driver-pin.yml b/.github/workflows/bundled-driver-pin.yml
index fe4f94a6..5249da9a 100644
--- a/.github/workflows/bundled-driver-pin.yml
+++ b/.github/workflows/bundled-driver-pin.yml
@@ -27,6 +27,11 @@ concurrency:
 jobs:
   behind:
     name: pin follows device-drivers
+    # Forks inherit this schedule as soon as they sync master, and the run can
+    # only misfire there: the tracking issue belongs on srcfl/ftw, and a fork
+    # with issues disabled turns every quiet morning into a failure email for
+    # its owner. A manual dispatch is someone asking, so that still runs.
+    if: github.repository == 'srcfl/ftw' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/.github/workflows/rpi-image-build.yml b/.github/workflows/rpi-image-build.yml
index d5436207..5ffb0e89 100644
--- a/.github/workflows/rpi-image-build.yml
+++ b/.github/workflows/rpi-image-build.yml
@@ -87,7 +87,13 @@ jobs:
 
   build:
     name: build RPi installer image
-    if: github.event_name != 'pull_request'
+    # The schedule is upstream's refresh cadence, not the fork's: a fork that
+    # syncs master would otherwise spend an hour of runner time every month
+    # publishing an installer release nobody asked its owner for. Pushes and
+    # manual dispatches on a fork are deliberate, so those still build.
+    if: >-
+      github.event_name != 'pull_request' &&
+      (github.event_name != 'schedule' || github.repository == 'srcfl/ftw')
     # Native arm64. pi-gen debootstraps an arm64 rootfs and then runs every
     # stage's scripts inside it, so on an x86 runner the whole build executes
     # under qemu-user-static instruction emulation — which is what made this