diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e3c19f..31da582 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,16 +1,19 @@
 name: ci
 
-# greentree's CI is `greentree serve` on a warm machine, which verifies
-# every pushed commit and posts greentree/<check> statuses. This workflow
-# is the cold-isolation fallback for pull requests (fork code should not
-# run on the warm runner). It installs greentree from the checkout and
-# runs the same `full` check the serve loop runs.
+# The cold-isolation fallback, for pull requests from FORKS only. Code from
+# a fork is untrusted and cannot have been attested in a workspace, so it
+# runs here in an ephemeral runner. Branches within this repo are verified
+# before the push and carry a greentree/full status already, so this job
+# skips them rather than re-running cold CI (which the pre-push gate exists
+# to avoid). It installs greentree from the checkout and runs the same
+# `full` check.
 
 on:
   pull_request:
 
 jobs:
   check:
+    if: github.event.pull_request.head.repo.fork == true
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]