diff --git a/.github/workflows/deploy-cloudflare-workers.yml b/.github/workflows/deploy-cloudflare-workers.yml
index 0d00ea2..208a73b 100644
--- a/.github/workflows/deploy-cloudflare-workers.yml
+++ b/.github/workflows/deploy-cloudflare-workers.yml
@@ -1,4 +1,4 @@
-name: Build and Deploy Cloudflare Worker
+name: Cloudflare Worker
 
 on:
   push:
@@ -20,6 +20,7 @@ concurrency:
 
 jobs:
   validate-and-build:
+    name: Build static site
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -43,10 +44,12 @@ jobs:
         run: pnpm build
 
       - name: Validate Worker deployment
+        if: github.repository == 'devcongress/website' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
         run: pnpm wrangler deploy --dry-run
 
   deploy:
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    name: Deploy Cloudflare Worker
+    if: github.repository == 'devcongress/website' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     needs: validate-and-build
     runs-on: ubuntu-latest
     environment:
@@ -72,10 +75,22 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - name: Deploy static site
-        uses: cloudflare/wrangler-action@v3
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          wranglerVersion: '4.107.1'
-          command: deploy
+      - name: Check production deployment configuration
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          if [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
+            echo "::error::Production deployment is not configured."
+            exit 1
+          fi
+
+      - name: Deploy Cloudflare Worker
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          if ! pnpm wrangler deploy > "$RUNNER_TEMP/wrangler-deploy.log" 2>&1; then
+            echo "::error::Production deployment failed."
+            exit 1
+          fi
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e679565..876af90 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-name: Build and Deploy GitHub Pages
+name: GitHub Pages
 
 on:
   push:
@@ -13,8 +13,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: github-pages
@@ -22,6 +20,7 @@ concurrency:
 
 jobs:
   build:
+    name: Build static site
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -45,15 +44,20 @@ jobs:
         run: pnpm build
 
       - name: Upload GitHub Pages artifact
-        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        if: github.repository == 'devcongress/website' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
         uses: actions/upload-pages-artifact@v3
         with:
           path: dist/
 
   deploy:
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    name: Deploy GitHub Pages
+    if: github.repository == 'devcongress/website' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/README.md b/README.md
index 65b9fd6..6552a21 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,8 @@ Before the first production deployment, repository administrators must create th
 - `CLOUDFLARE_ACCOUNT_ID` — the Cloudflare account that owns the Worker and `devcongress.org` zone.
 
 The first deployment should be validated at its Workers preview URL. Attach `devcongress.org` only after URL/content parity checks pass. GitHub Pages continues to deploy independently during the agreed soak window and remains the rollback path.
+
+Forks and fork-origin pull requests run the build jobs only. GitHub Pages artifacts, Workers dry-run validation, protected environments, and production deployments run only from `devcongress/website` itself.
 ## 👀 Want to learn more?
 
 Feel free to check [our documentation](https://docs.astro.build) or jump into our [Discord server](https://astro.build/chat).