diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index 89944d0..dd2d57f 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -15,6 +15,9 @@ concurrency:
 jobs:
   prune:
     name: Prune old nightly releases
+    # Canonical repo only on the weekly cron -- see master.yml's preflight.
+    # Dispatch runs are unaffected.
+    if: github.event_name != 'schedule' || github.repository == 'OpenIPC/builder'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/manifest.yml b/.github/workflows/manifest.yml
index 58e3e57..723e4f1 100644
--- a/.github/workflows/manifest.yml
+++ b/.github/workflows/manifest.yml
@@ -19,9 +19,16 @@ jobs:
     # transient toolchain 502) should not deny manifest updates for the
     # platforms that did upload artifacts. enrich_manifest.py reads
     # whatever assets actually exist on the release.
+    #
+    # First clause: on a mirror the nightly's jobs skip, but the run still
+    # completes and fires workflow_run, so gate the cron-originated path on
+    # the canonical repo too -- see master.yml's preflight. Dispatch-driven
+    # manifest regeneration is untouched anywhere.
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      contains(fromJSON('["success", "failure"]'), github.event.workflow_run.conclusion)
+      (github.event.workflow_run.event != 'schedule' ||
+       github.repository == 'OpenIPC/builder') &&
+      (github.event_name == 'workflow_dispatch' ||
+       contains(fromJSON('["success", "failure"]'), github.event.workflow_run.conclusion))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout master (for the script)
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 4f394b4..c8b86cb 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -11,6 +11,22 @@ on:
 jobs:
   preflight:
     name: Preflight
+    # Guard rail for clones of this repo. A clone pushed to a new repository
+    # (a private mirror, an internal re-host) inherits this file along with
+    # its cron, and the full platform matrix then runs on that owner's Actions
+    # bill, nightly and unattended, publishing nightlies nobody reads. Forks
+    # are partially covered (GitHub disables scheduled workflows there), a
+    # fresh repository is not. Mirrors OpenIPC/firmware#2255.
+    #
+    # Unattended runs happen only on the canonical repo. Anywhere else a
+    # workflow runs only if someone explicitly asked for it, or if it is both
+    # free and attended. The pull_request clause is unreachable today -- this
+    # workflow has no pull_request trigger -- and is kept deliberately, so
+    # that adding one later does not silently skip CI on contributor forks.
+    if: >-
+      github.repository == 'OpenIPC/builder' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && !github.event.repository.private)
     runs-on: ubuntu-latest
     outputs:
       should_build: ${{ steps.gate.outputs.should_build }}