diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b1e3f1f..34589883 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -477,6 +477,8 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     needs: [manylinux, musllinux, windows, macos, android, sdist, tests, pypy311, style]
+    # Fork PRs get no id-token, so attestation and the publish dry-run can't run there.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       # Use to sign the release artifacts
       id-token: write