diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0917002d47..4f7e0ea79f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,7 +10,7 @@ jobs:
   publish-vscode-extension:
     name: Publish VSCode extension
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }}
     environment: production
     env:
       CURSORLESS_REPO_ROOT: ${{ github.workspace }}
@@ -50,7 +50,7 @@ jobs:
   publish-neovim-extension:
     name: Publish Neovim extension
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }}
     environment: production
     env:
       CURSORLESS_REPO_ROOT: ${{ github.workspace }}
@@ -99,6 +99,7 @@ jobs:
   push-cursorless-talon:
     name: Push cursorless-talon subrepo
     runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }}
     needs: publish-vscode-extension
     environment: production
     env: