diff --git a/.github/workflows/docker-branch-releases.yml b/.github/workflows/docker-branch-releases.yml
index d8243bcd076..2265c18f572 100644
--- a/.github/workflows/docker-branch-releases.yml
+++ b/.github/workflows/docker-branch-releases.yml
@@ -24,6 +24,8 @@ jobs:
   push-updater-image:
     name: Export dependabot-updater image to build artifacts
     runs-on: ubuntu-latest
+    # can't run on forks since it requires write access to GHCR
+    if: github.event.pull_request == '' || github.event.pull_request.head.repo.name == github.repository
     permissions:
       contents: read
       packages: write