diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5a34e41..ab7b5f0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -18,6 +18,10 @@ jobs:
   test:
     name: Test
     runs-on: [self-hosted, Linux, X64]
+    # Do not run untrusted fork PR code on the self-hosted runner.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     strategy:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]