diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de1f801e..f45ea70a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -202,8 +202,10 @@ jobs:
     name: Publish and sign commit image (${{ matrix.arch }})
     needs: image-smoke-and-scan
     if: >-
-      github.ref == 'refs/heads/master' &&
-      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+      (github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository) ||
+      ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
+      github.ref == 'refs/heads/master')
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
@@ -279,8 +281,10 @@ jobs:
     name: Publish and sign multi-architecture commit image
     needs: publish-image
     if: >-
-      github.ref == 'refs/heads/master' &&
-      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+      (github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository) ||
+      ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
+      github.ref == 'refs/heads/master')
     runs-on: ubuntu-24.04
     permissions:
       contents: read