diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index 6a4b8909..306a523b 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -58,5 +58,5 @@ jobs:
       registry: cmsacontainerreg.azurecr.io
       app_name: ${{ matrix.app_name }}
       dockerfile: ${{ matrix.dockerfile }}
-      push: ${{ github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'hotfix' }}
+      push: ${{ github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'hotfix') }}
     secrets: inherit
\ No newline at end of file
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index de29a9c4..1c6159af 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -19,14 +19,15 @@ on:
 jobs:
   docker-build:
     runs-on: ubuntu-latest
-    environment: production
+    # Pull request runs (including forks) never use the production environment or Azure credentials.
+    environment: ${{ github.event_name != 'pull_request' && 'production' || '' }}
     steps:
 
     - name: Checkout
       uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     - name: Login to Azure
-      if: ${{ inputs.push }}
+      if: ${{ inputs.push && github.event_name != 'pull_request' }}
       uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
@@ -34,7 +35,7 @@ jobs:
         subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
     - name: Login to ACR
-      if: ${{ inputs.push }}
+      if: ${{ inputs.push && github.event_name != 'pull_request' }}
       run: az acr login --name ${{ inputs.registry }}
 
     - name: Set up Docker Buildx
diff --git a/.github/workflows/deploy-v2.yml b/.github/workflows/deploy-v2.yml
index 49276e43..686bf5d9 100644
--- a/.github/workflows/deploy-v2.yml
+++ b/.github/workflows/deploy-v2.yml
@@ -99,6 +99,12 @@ on:
 
 jobs:
   validate-inputs:
+    # Only deploy for non-PR workflow_run events from this repository (not forks) whose build succeeded.
+    if: >-
+      github.event_name != 'workflow_run' ||
+      (github.event.workflow_run.head_repository.full_name == github.repository &&
+       github.event.workflow_run.event != 'pull_request' &&
+       github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     outputs:
       validation_passed: ${{ steps.validate.outputs.passed }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 16d22ad0..26c29871 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,6 +23,12 @@ env:
 
 jobs:
   deploy:
+    # Only deploy for non-PR workflow_run events from this repository (not forks) whose build succeeded.
+    if: >-
+      github.event_name != 'workflow_run' ||
+      (github.event.workflow_run.head_repository.full_name == github.repository &&
+       github.event.workflow_run.event != 'pull_request' &&
+       github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     environment: production
     outputs: