diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 6fd589b..630f00d 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -29,7 +29,18 @@ jobs:
       packages: write
       id-token: write
       attestations: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v') }}
+    if: >-
+      ${{
+        github.event_name == 'workflow_dispatch' ||
+        startsWith(github.ref, 'refs/tags/v') ||
+        (
+          github.event_name == 'workflow_run' &&
+          github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' &&
+          github.event.workflow_run.head_repository.full_name == github.repository
+        )
+      }}
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/pages-eo.yml b/.github/workflows/pages-eo.yml
index b618af0..23720fa 100644
--- a/.github/workflows/pages-eo.yml
+++ b/.github/workflows/pages-eo.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.head_repository.full_name == github.repository) }}
 
     steps:
       - name: Checkout pages branch
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 9ecec56..ed076d6 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.head_repository.full_name == github.repository) }}
 
     steps:
       - name: Checkout main branch
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.head_repository.full_name == github.repository) }}
 
     steps:
       - name: Checkout main branch
diff --git a/.github/workflows/workers.yml b/.github/workflows/workers.yml
index 6e62c7d..50a27be 100644
--- a/.github/workflows/workers.yml
+++ b/.github/workflows/workers.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.head_repository.full_name == github.repository) }}
     steps:
       - name: Checkout main branch
         uses: actions/checkout@v6