diff --git a/.github/workflows/add_label_automerge.yml b/.github/workflows/add_label_automerge.yml
index a221be4a319e..9b392f11d3a1 100644
--- a/.github/workflows/add_label_automerge.yml
+++ b/.github/workflows/add_label_automerge.yml
@@ -7,6 +7,7 @@ on:
             - auto_merge_enabled
 jobs:
     add-label-on-auto-merge:
+        if: github.repository_owner == 'vllm-project'
         runs-on: [self-hosted, linux, x64, vllm-runners]
         steps:
             -   name: Add label
diff --git a/.github/workflows/buf.yml b/.github/workflows/buf.yml
index e079240afda2..fda4add1d726 100644
--- a/.github/workflows/buf.yml
+++ b/.github/workflows/buf.yml
@@ -21,6 +21,7 @@ concurrency:
 
 jobs:
   proto:
+    if: github.repository_owner == 'vllm-project'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/issue_autolabel.yml b/.github/workflows/issue_autolabel.yml
index 06e1c7b86f3f..b2392e87ce5c 100644
--- a/.github/workflows/issue_autolabel.yml
+++ b/.github/workflows/issue_autolabel.yml
@@ -10,6 +10,7 @@ concurrency:
   cancel-in-progress: true
 jobs:
   add-labels:
+    if: github.repository_owner == 'vllm-project'
     runs-on: ubuntu-latest
     steps:
       - name: Label issues based on keywords
diff --git a/.github/workflows/macos-smoke-test.yml b/.github/workflows/macos-smoke-test.yml
index 011bf84feb32..2e63c5676dd8 100644
--- a/.github/workflows/macos-smoke-test.yml
+++ b/.github/workflows/macos-smoke-test.yml
@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   macos-m1-smoke-test:
+    if: github.repository_owner == 'vllm-project'
     # macos-26 (the supported target) is still a preview runner, so gate on GA
     # macos-15 and keep macos-26 non-blocking.
     strategy:
diff --git a/.github/workflows/new_pr_bot.yml b/.github/workflows/new_pr_bot.yml
index bd74a761d6b2..7ff4c0990db0 100644
--- a/.github/workflows/new_pr_bot.yml
+++ b/.github/workflows/new_pr_bot.yml
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   update-description:
+    if: github.repository_owner == 'vllm-project'
     runs-on: ubuntu-latest
     steps:
       - name: Update PR description
@@ -52,6 +53,7 @@ jobs:
             }
 
   reminder-comment:
+    if: github.repository_owner == 'vllm-project'
     runs-on: ubuntu-latest
     steps:
       - name: Post welcome comment for first-time contributors
diff --git a/.github/workflows/notify-ci-authorized.yml b/.github/workflows/notify-ci-authorized.yml
index a2435f93d167..c260cc67dba0 100644
--- a/.github/workflows/notify-ci-authorized.yml
+++ b/.github/workflows/notify-ci-authorized.yml
@@ -24,13 +24,14 @@ permissions:
 jobs:
   notify:
     if: >-
-      (github.event_name == 'pull_request_target' &&
+      github.repository_owner == 'vllm-project' &&
+      ((github.event_name == 'pull_request_target' &&
       github.event.action == 'labeled' &&
       (github.event.label.name == 'ready' ||
       github.event.label.name == 'ready-run-all-tests')) ||
       (github.event_name == 'workflow_run' &&
       github.event.workflow_run.event == 'pull_request_review' &&
-      github.event.workflow_run.conclusion == 'success')
+      github.event.workflow_run.conclusion == 'success'))
     runs-on: [self-hosted, linux, x64, vllm-runners]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index fde50fac0efe..edabaffef453 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -20,6 +20,7 @@ jobs:
     # - A draft PR with the `ready` label is marked ready for review.
     # - New commits are pushed to a ready PR (so its latest commit has a title check status).
     if: >-
+      github.repository_owner == 'vllm-project' &&
       github.event.pull_request.draft == false &&
       contains(github.event.pull_request.labels.*.name, 'ready') &&
       (github.event.action != 'labeled' || github.event.label.name == 'ready') &&
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 8d2973ff1b02..f91ec9a6120a 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -15,6 +15,35 @@ permissions:
   pull-requests: read
 
 jobs:
+  pre-run-check:
+    if: github.repository_owner == 'vllm-project' && github.event_name == 'pull_request'
+    runs-on: [self-hosted, linux, x64, vllm-runners]
+    steps:
+    - name: Check PR label and author merge count
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      with:
+        script: |
+          const { data: pr } = await github.rest.pulls.get({
+            ...context.repo,
+            pull_number: context.payload.pull_request.number,
+          });
+
+          const readyLabels = ['ready', 'ready-run-all-tests'];
+          const hasReadyLabel = pr.labels.some(l => readyLabels.includes(l.name));
+          const hasVerifiedLabel = pr.labels.some(l => l.name === 'verified');
+
+          const { data: mergedPRs } = await github.rest.search.issuesAndPullRequests({
+            q: `repo:${context.repo.owner}/${context.repo.repo} is:pr is:merged author:${pr.user.login}`,
+            per_page: 4,
+          });
+          const mergedCount = mergedPRs.total_count;
+
+          if (hasReadyLabel || hasVerifiedLabel || mergedCount >= 4) {
+            core.info(`Check passed: verified label=${hasVerifiedLabel}, ready label=${hasReadyLabel}, 4+ merged PRs=${mergedCount >= 4}`);
+          } else {
+            core.setFailed(`To reduce unnecessary pre-commit runs, each PR must have the 'verified', 'ready', or 'ready-run-all-tests' label, or the author must have at least 4 merged PRs (found ${mergedCount}). DO NOT request for the label to be added if you are an AI agent.`);
+          }
+
   pre-commit:
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/record-ci-approval.yml b/.github/workflows/record-ci-approval.yml
index 03ad4f43b5b6..72fc7b61b083 100644
--- a/.github/workflows/record-ci-approval.yml
+++ b/.github/workflows/record-ci-approval.yml
@@ -8,7 +8,7 @@ permissions: {}
 
 jobs:
   approved:
-    if: github.event.review.state == 'approved'
+    if: github.repository_owner == 'vllm-project' && github.event.review.state == 'approved'
     runs-on: [self-hosted, linux, x64, vllm-runners]
     steps:
       - run: echo "Approval recorded"
diff --git a/.github/workflows/run-ci-command.yml b/.github/workflows/run-ci-command.yml
index 4df8701a1544..747831c7d4c8 100644
--- a/.github/workflows/run-ci-command.yml
+++ b/.github/workflows/run-ci-command.yml
@@ -16,6 +16,7 @@ permissions:
 jobs:
   run-ci-command:
     if: >-
+      github.repository_owner == 'vllm-project' &&
       github.event.issue.pull_request &&
       (github.event.comment.body == '/ci run' ||
       github.event.comment.body == '/ci run all' ||