diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cfd5b64..51a6151 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,9 +1,11 @@
 name: CI
 
+# Only pushes to this repository, no pull_request: the runner allows privileged
+# containers, and a pull request from a fork could otherwise run its own
+# workflow with root access on the runner machine.
 on:
   push:
     branches: ["**"]
-  pull_request:
 
 jobs:
   test-bookworm: