diff --git a/.github/workflows/sync-cnb.yml b/.github/workflows/sync-cnb.yml
index d4bd1222fa..37c07ba92b 100644
--- a/.github/workflows/sync-cnb.yml
+++ b/.github/workflows/sync-cnb.yml
@@ -62,6 +62,7 @@ permissions:
 
 jobs:
   sync:
+    if: github.repository_owner == 'codewhale-hq'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
diff --git a/docs/CNB_MIRROR.md b/docs/CNB_MIRROR.md
index 4db4c724a9..44298307c1 100644
--- a/docs/CNB_MIRROR.md
+++ b/docs/CNB_MIRROR.md
@@ -53,7 +53,10 @@ GitHub Actions workflow:
   recovery. A tag push alone does not mirror a release tag. Manual tag recovery
   also verifies the complete public GitHub asset inventory and immutable source.
 - **Auth:** HTTPS basic auth as user `cnb` with the `CNB_GIT_TOKEN`
-  repository secret as the password.
+  repository secret as the password. Forks never inherit the secret, so the
+  `sync` job runs only when the repository owner is `codewhale-hq`; on a fork
+  it is skipped instead of failing. In this repository a missing or misspelled
+  secret still fails the push step.
 - **Scope:** only the ref that triggered the run is pushed. Tag pushes
   push exactly that tag. Branch pushes mirror `main`, first-party
   `fix/*`/`rebrand/*` branches, or explicitly matched release branches. Other
diff --git a/docs/zh_hans/CNB_MIRROR.md b/docs/zh_hans/CNB_MIRROR.md
index a02bb30355..90135e380c 100644
--- a/docs/zh_hans/CNB_MIRROR.md
+++ b/docs/zh_hans/CNB_MIRROR.md
@@ -48,7 +48,9 @@ sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing
   `workflow_dispatch`。仅推送标签不会触发发布标签镜像。手动恢复标签也必须
   验证 GitHub 已公开的完整资产清单及不可变的源码提交。
 - **认证：** HTTPS basic auth，用户名为 `cnb`，密码是仓库 secret
-  `CNB_GIT_TOKEN`。
+  `CNB_GIT_TOKEN`。fork 永远不会继承这个 secret，所以 `sync` 作业只在仓库所有者为
+  `codewhale-hq` 时运行；在 fork 上会被跳过而不是失败。本仓库中 secret 缺失或拼写
+  错误时，push 步骤仍会失败。
 - **范围：** 只推送触发本次运行的那个 ref。标签推送就推送该标签。分支推送镜像
   `main`、第一方 `fix/*`/`rebrand/*` 分支，或显式匹配的发布分支。其他功能分支
   和 dependabot ref 有意*不*镜像。