diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cab4b4e2b..f28d707bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-server-latest]
+        os: ${{ fromJSON((github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }}
     defaults:
       run:
         shell: bash
@@ -123,7 +123,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-server-latest]
+        os: ${{ fromJSON((github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }}
         group: [gateway, claude, codex, gemini, opencode, copilot, pi]
         include:
           - group: gateway
diff --git a/tests/test_integration_contract.py b/tests/test_integration_contract.py
index e4bb63ee0..8e41aac1f 100644
--- a/tests/test_integration_contract.py
+++ b/tests/test_integration_contract.py
@@ -142,8 +142,8 @@ def test_cuj_discovery_fails_for_a_file_without_a_check_name(tmp_path):
 }
 
 
-def _integration_jobs():
-    workflow = (Path(__file__).parent.parent / ".github/workflows/integration.yml").read_text()
+def _integration_jobs(name="integration.yml"):
+    workflow = (Path(__file__).parent.parent / ".github/workflows" / name).read_text()
     body = workflow.split("\njobs:\n", 1)[1]
     return dict(re.findall(r"(?ms)^  ([a-z0-9-]+):\n(.*?)(?=^  [a-z0-9-]+:\n|\Z)", body))
 
@@ -174,6 +174,19 @@ def test_integration_jobs_that_run_on_fork_pull_requests_need_no_credentials():
         )
 
 
+def test_ci_windows_lanes_skip_fork_pull_requests():
+    jfrog_jobs = {
+        name: job for name, job in _integration_jobs("ci.yml").items() if "setup-jfrog-cli" in job
+    }
+
+    assert set(jfrog_jobs) == {"test", "e2e-shards"}
+    for name, job in jfrog_jobs.items():
+        assert (
+            f"os: ${{{{ fromJSON(({FORK_GUARD}) && "
+            """'["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }}"""
+        ) in job, f"{name} logs in to JFrog with OIDC on Windows, which fork PRs can't do"
+
+
 def test_windows_integration_ci_uses_shared_claude_version():
     workflow = Path(__file__).parent.parent / ".github/workflows/integration.yml"
     contents = workflow.read_text()