diff --git a/.github/workflows/deploy-relay.yml b/.github/workflows/deploy-relay.yml
index da3ac329ee26..089f14c01642 100644
--- a/.github/workflows/deploy-relay.yml
+++ b/.github/workflows/deploy-relay.yml
@@ -17,10 +17,10 @@ concurrency:
 jobs:
   deploy_relay:
     name: Deploy production relay
-    # Upstream-only: the fork has neither the blacksmith runners nor the
-    # Cloudflare credentials, so the job would queue forever here.
-    if: github.repository == 'pingdotgg/t3code'
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    # Fork-only and explicitly opt-in. This prevents accidental upstream deploys
+    # and keeps the fork from queueing private upstream runners by default.
+    if: github.repository == 'aaditagrawal/t3code' && vars.RELAY_DEPLOY_ENABLED == 'true'
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     environment:
       name: production
diff --git a/.github/workflows/mobile-eas-preview.yml b/.github/workflows/mobile-eas-preview.yml
index a57cefe4d9ab..4987b70c9702 100644
--- a/.github/workflows/mobile-eas-preview.yml
+++ b/.github/workflows/mobile-eas-preview.yml
@@ -2,14 +2,16 @@ name: Mobile EAS Preview
 
 on:
   pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
 
 jobs:
   preview:
     name: EAS Preview
-    # Upstream-only: the fork has neither the blacksmith runners nor the
-    # Expo credentials, so the job would queue forever here.
-    if: github.repository == 'pingdotgg/t3code'
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    # Fork-only and label-gated. Keep this off upstream and avoid private
+    # upstream runners; the token check below skips the body when EAS is not
+    # configured for the fork.
+    if: github.repository == 'aaditagrawal/t3code' && contains(github.event.pull_request.labels.*.name, '🚀 Mobile Continuous Deployment')
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
diff --git a/apps/mobile/app.config.ts b/apps/mobile/app.config.ts
index 7cbb8335deb6..73b5ff53de3f 100644
--- a/apps/mobile/app.config.ts
+++ b/apps/mobile/app.config.ts
@@ -170,7 +170,7 @@ const config: ExpoConfig = {
       projectId: "d763fcb8-d37c-41ea-a773-b54a0ab4a454",
     },
   },
-  owner: "pingdotgg",
+  owner: repoEnv.EXPO_OWNER ?? "aaditagrawal",
 };
 
 export default config;