diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cf258e5..e6810d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,11 +19,13 @@ jobs:
     runs-on: macos-15
     permissions:
       contents: read
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]'))
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Lint
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 79a4069..27aba2d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,6 +54,7 @@ jobs:
     needs: checks
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    environment: release
     permissions:
       contents: write
     outputs:
@@ -379,6 +380,7 @@ jobs:
     needs: [create-tag, build-and-release]
     if: failure() && needs.create-tag.result == 'success'
     runs-on: ubuntu-latest
+    environment: release
     permissions:
       contents: write
     steps: