diff --git a/.github/workflows/marketplace-v2-live.yml b/.github/workflows/marketplace-v2-live.yml
index a27638ad17..037a07dd38 100644
--- a/.github/workflows/marketplace-v2-live.yml
+++ b/.github/workflows/marketplace-v2-live.yml
@@ -11,6 +11,11 @@ permissions:
 jobs:
   validate:
     name: Parse the live v2 marketplace
+    # Scheduled runs are restricted to the canonical repository so that forks,
+    # on which GitHub happily runs cron workflows, do not run the validation
+    # against the upstream marketplace for no benefit. Manual dispatch keeps
+    # working in forks.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'get-bb/bb' }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
diff --git a/.github/workflows/mobile-e2e.yml b/.github/workflows/mobile-e2e.yml
index bb2af6f107..737bc1e976 100644
--- a/.github/workflows/mobile-e2e.yml
+++ b/.github/workflows/mobile-e2e.yml
@@ -53,9 +53,14 @@ env:
 jobs:
   ios:
     name: iOS simulator flows
+    # Scheduled (nightly) runs are restricted to the canonical repository so
+    # that forks, on which GitHub happily runs cron workflows, do not burn
+    # macOS runner time they do not have. Label gating and manual dispatch
+    # keep working in forks.
     if: >-
-      github.event_name != 'pull_request' ||
-      contains(github.event.pull_request.labels.*.name, 'mobile-e2e')
+      github.repository == 'get-bb/bb'
+      && (github.event_name != 'pull_request'
+      || contains(github.event.pull_request.labels.*.name, 'mobile-e2e'))
     runs-on: blacksmith-6vcpu-macos-15
     timeout-minutes: 90
 
diff --git a/.github/workflows/publish-bb-app.yml b/.github/workflows/publish-bb-app.yml
index 4df91f84e0..5e3949bdce 100644
--- a/.github/workflows/publish-bb-app.yml
+++ b/.github/workflows/publish-bb-app.yml
@@ -50,6 +50,12 @@ env:
 jobs:
   publish:
     name: Publish bb-app
+    # Scheduled (nightly) runs are restricted to the canonical repository so
+    # that forks, on which GitHub happily runs cron workflows, do not execute
+    # release jobs that publish to npm, reset the desktop-nightly release and
+    # need signing or notarization secrets they will never have. Manual
+    # workflow_dispatch runs keep working in forks.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'get-bb/bb' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: npm-release
@@ -372,6 +378,10 @@ jobs:
   # docs/bb-release-process.md#publishing-the-plugin-sdk.
   publish-plugin-sdk:
     name: Publish @get-bb/plugin-sdk
+    # Same fork guard as the publish job: this job also runs on the schedule
+    # trigger, while the nightly desktop, iOS and release-publish jobs stay
+    # behind `needs` chains rooted at it.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'get-bb/bb' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: npm-release