diff --git a/.github/workflows/release-brew.yml b/.github/workflows/release-brew.yml
index c04f0b4e6e..d31ca30f36 100644
--- a/.github/workflows/release-brew.yml
+++ b/.github/workflows/release-brew.yml
@@ -33,7 +33,14 @@ permissions:
 jobs:
   publish:
     name: Publish formula to homebrew-tap
-    if: ${{ github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'moq-') }}
+    # workflow_run has the base repository's privileges and this job checks out
+    # the triggering commit, so accept only a successful tag push in this
+    # repository: a fork PR can rename a workflow and its branch to match.
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      startsWith(github.event.workflow_run.head_branch, 'moq-')
     runs-on: ubuntu-latest
 
     steps: