diff --git a/.github/workflows/maestro-local.yml b/.github/workflows/maestro-local.yml
index 739c67764a..0f12912120 100644
--- a/.github/workflows/maestro-local.yml
+++ b/.github/workflows/maestro-local.yml
@@ -20,6 +20,9 @@ jobs:
   build-apk:
     name: Build APK
     runs-on: ubuntu-latest
+    # Secrets are not available to pull_request runs from forks, so the Maestro job below
+    # cannot run for them; skip the build too, as its only consumer is that job.
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     concurrency:
       group: ${{ format('maestro-build-{0}', github.ref) }}
       cancel-in-progress: true
@@ -73,13 +76,13 @@ jobs:
     name: Maestro test suite
     runs-on: ubuntu-latest
     needs: [ build-apk ]
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     # Allow only one to run at a time, since they use the same environment.
     # Otherwise, tests running in parallel can break each other.
     concurrency:
       group: maestro-test
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        if: (github.event_name == 'pull_request' && github.event.pull_request.fork == null) || github.event_name == 'workflow_dispatch'
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881