diff --git a/.github/workflows/create-package.yml b/.github/workflows/create-package.yml
index 0d56489..6932c5c 100644
--- a/.github/workflows/create-package.yml
+++ b/.github/workflows/create-package.yml
@@ -9,7 +9,8 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - name: Docker login gcr.io
+            - if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
+              name: Docker login gcr.io
               uses: docker/login-action@v1
               with:
                 password: ${{ secrets.RIFF_GCLOUD_SERVICE_ACCOUNT_KEY }}
diff --git a/.github/workflows/minimal-labels.yml b/.github/workflows/minimal-labels.yml
index baf42c0..1bb1fd6 100644
--- a/.github/workflows/minimal-labels.yml
+++ b/.github/workflows/minimal-labels.yml
@@ -1,6 +1,6 @@
 name: Minimal Labels
 "on":
-    pull_request_target:
+    pull_request:
         types:
             - synchronize
             - reopened
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 1b9fb5c..dd3e378 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,6 +1,6 @@
 name: Tests
 "on":
-    pull_request_target: {}
+    pull_request: {}
     push:
         branches:
             - main
@@ -10,7 +10,8 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - name: Docker login gcr.io
+            - if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
+              name: Docker login gcr.io
               uses: docker/login-action@v1
               with:
                 password: ${{ secrets.RIFF_GCLOUD_SERVICE_ACCOUNT_KEY }}