diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 9e8a7fa7..210d1237 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -77,6 +77,12 @@ jobs:
         file: ./coverage.xml
   sphinx:
     # If the above worked:
-    # Build docs and upload to GH Pages
+    # Build docs and upload to GH Pages -- only on push (merge to master/future),
+    # never on pull_request: a PR whose branch lives in a fork (including the
+    # author's own fork) gets a read-only GITHUB_TOKEN by GitHub's own design,
+    # so the gh-pages push step always fails there regardless of repo settings.
+    # Publishing unreviewed PR content to the live docs site isn't desired
+    # either way.
     needs: unittest
+    if: ${{ github.event_name != 'pull_request' }}
     uses: ./.github/workflows/sphinx.yml
diff --git a/.github/workflows/sphinx.yml b/.github/workflows/sphinx.yml
index c0beb95a..445d7181 100644
--- a/.github/workflows/sphinx.yml
+++ b/.github/workflows/sphinx.yml
@@ -6,7 +6,6 @@ on:
 jobs:
   sphinx:
     runs-on: ubuntu-22.04
-    # if: ${{ github.event_name != 'pull_request' }}
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python 3.12