diff --git a/.github/workflows/macos-check.yml b/.github/workflows/macos-check.yml
index de670993..57f62d0e 100644
--- a/.github/workflows/macos-check.yml
+++ b/.github/workflows/macos-check.yml
@@ -26,6 +26,20 @@ concurrency:
 
 jobs:
   check:
+    # Never run a fork's code on the self-hosted runner. cargo build/clippy/test
+    # all execute whatever the PR supplies -- build.rs, proc-macro crates, a
+    # swapped Cargo.toml dependency, the test bodies themselves -- and this
+    # runner is the same machine that builds, signs and uploads every macOS
+    # release. Nothing here cleans the workspace, so an implant in ~/.cargo,
+    # ~/.rustup or the persistent _work tree would survive into the next
+    # release. permissions: {} limits the token, not code execution.
+    #
+    # GitHub's public-repo default only gates *first-time* contributors, so one
+    # trivial merged PR is enough to unlock this for a later one. Fork PRs get a
+    # maintainer-triggered workflow_dispatch run instead.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     # Runner must be darwin/arm64 with Xcode CLT and rustup (same requirements
     # as macos-release.yml, which this intentionally does not replace -- this
     # only builds/checks, never signs, packages, or uploads anything).
diff --git a/.github/workflows/windows-check.yml b/.github/workflows/windows-check.yml
index a567d294..e072eb80 100644
--- a/.github/workflows/windows-check.yml
+++ b/.github/workflows/windows-check.yml
@@ -27,6 +27,15 @@ concurrency:
 
 jobs:
   check:
+    # Never run a fork's code on the self-hosted runner -- see the same guard in
+    # macos-check.yml. cargo build/clippy/test execute whatever the PR supplies
+    # (build.rs, proc-macro crates, a swapped Cargo.toml dependency, the test
+    # bodies), nothing here cleans the workspace, and this runner also builds
+    # the Windows release. Fork PRs get a maintainer-triggered
+    # workflow_dispatch run instead.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     # Runner must have rustup and the MSVC toolchain (same requirements as
     # windows-release.yml, which this intentionally does not replace -- this
     # only builds/checks, never packages or uploads anything).