diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8df3ca7f..2119bfad 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,6 +11,10 @@ permissions:
 
 jobs:
   release:
+    # Releases are cut from the upstream repository only. Without this guard the
+    # workflow also runs on forks, where semantic-release rewrites the version in
+    # pyproject.toml, commits to the default branch and attempts a PyPI upload.
+    if: github.repository == 'appium/python-client'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7