diff --git a/.github/workflows/app_build.yml b/.github/workflows/app_build.yml
index 0a0bd8bb8..4f8fd988b 100644
--- a/.github/workflows/app_build.yml
+++ b/.github/workflows/app_build.yml
@@ -156,6 +156,14 @@ jobs:
         echo "There are $N threads available"
         echo "N=$N" >> $GITHUB_ENV
 
+        # Detect fork PRs — secrets are unavailable for external forks, so
+        # codesigning and artifact upload steps must be skipped for them.
+        if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
+          echo "IS_FORK_PR=true" >> $GITHUB_ENV
+        else
+          echo "IS_FORK_PR=false" >> $GITHUB_ENV
+        fi
+
         if [ "$RUNNER_OS" == "Linux" ]; then
           echo "Install needed system dependencies for OPENGL (due to Qt) for Linux"
           sudo apt update -qq
@@ -232,7 +240,7 @@ jobs:
 
     - name: "Configure for codesigning"
       id: codesigning
-      if: runner.os == 'macOS'
+      if: runner.os == 'macOS' && env.IS_FORK_PR != 'true'
       run: |
         set -x
         cd $RUNNER_TEMP
@@ -605,6 +613,7 @@ jobs:
           -WaitForCompletion -Force
 
     - name: Archive binary artifacts
+      if: env.IS_FORK_PR != 'true'
       uses: actions/upload-artifact@v4
       # build/_CPack_Packages/win64/IFW/*.exe
       # build/_CPack_Packages/Linux/DEB/*.deb
@@ -614,13 +623,14 @@ jobs:
         path: build/${{ matrix.BINARY_PKG_PATH }}/*.${{ env.BINARY_EXT }}
 
     - name: Archive TGZ or ZIP artifacts
+      if: env.IS_FORK_PR != 'true'
       uses: actions/upload-artifact@v4
       with:
         name: OpenStudioApplication-${{ env.OS_APP_VERSION }}.${{ github.sha }}-${{ matrix.os }}.${{ env.COMPRESSED_EXT }}
         path: build/${{ matrix.COMPRESSED_PKG_PATH }}/*.${{ env.COMPRESSED_EXT }}
 
     - name: Full Test Package signing for IFW and TGZ
-      if: runner.os == 'macOS'
+      if: runner.os == 'macOS' && env.IS_FORK_PR != 'true'
       working-directory: ./build
       shell: bash
       run: |
@@ -632,7 +642,7 @@ jobs:
         echo "::endgroup::"
 
     - name: Upload otool info as artifact
-      if: runner.os == 'macOS'
+      if: runner.os == 'macOS' && env.IS_FORK_PR != 'true'
       uses: actions/upload-artifact@v4
       with:
         name: otool_infos_cpack_${{ matrix.os }}_${{ matrix.arch }}
@@ -656,6 +666,7 @@ jobs:
         $XVFBCMD ctest -j -T test --output-on-failure --no-compress-output -C $BUILD_TYPE || true
 
     - name: Archive test results?
+      if: env.IS_FORK_PR != 'true'
       uses: actions/upload-artifact@v4
       with:
         name: OpenStudioApplication-${{ env.OS_APP_VERSION }}.${{ github.sha }}-${{ matrix.os }}-Test.xml
@@ -678,6 +689,7 @@ jobs:
         $XVFBCMD Products/SpacesSurfaces_Benchmark --benchmark_out_format=csv --benchmark_out='bench_results_SpacesSurfaces.csv' || true
 
     - name: Archive benchmark results?
+      if: env.IS_FORK_PR != 'true'
       uses: actions/upload-artifact@v4
       with:
         name: OpenStudioApplication-${{ env.OS_APP_VERSION }}.${{ github.sha }}-${{ matrix.os }}-bench_results.csv
@@ -723,6 +735,7 @@ jobs:
   test_package_macos:
     name: Test Built Package on macOS
     needs: build
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ${{ matrix.os }}
     strategy:
       # fail-fast: Default is true, switch to false to allow one platform to fail and still run others
diff --git a/.github/workflows/docker-ci.yml b/.github/workflows/docker-ci.yml
index adab56ce8..a584d9276 100644
--- a/.github/workflows/docker-ci.yml
+++ b/.github/workflows/docker-ci.yml
@@ -37,7 +37,7 @@ jobs:
         load: true
         tags: osapp-build:latest
         cache-from: type=gha,scope=osapp-build
-        cache-to:   type=gha,scope=osapp-build,mode=max
+        cache-to:   ${{ github.event.pull_request.head.repo.full_name == github.repository && 'type=gha,scope=osapp-build,mode=max' || '' }}
 
     - name: Configure (Conan install + CMake configure)
       run: make configure