diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7cb6913671..1f28d05d74 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,7 +54,7 @@ env:
   release: ${{ startsWith(github.ref, 'refs/tags/v') }}
   branch: ${{ github.base_ref || github.ref_name }}
   cache_o0: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/stable') }}
-  release_branch: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/stable') && github.ref_name || '' }}
+  release_branch: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/stable') && github.repository == 'simplex-chat/simplex-chat' && github.ref_name || '' }}
   ZSTD_CLEVEL: 9
 
 # This workflow uses custom actions (prepare-build and prepare-release) defined in:
@@ -124,7 +124,7 @@ jobs:
       publish: ${{ steps.publish.outputs.nodejs_version || steps.publish.outputs.python_version }}
       packages: ${{ steps.changes.outputs.packages }}
       scopes: ${{ steps.changes.outputs.scopes }}
-      reduced: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == true }}
+      reduced: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == true || (github.event_name == 'push' && github.ref_type == 'branch' && github.repository != 'simplex-chat/simplex-chat') }}
     steps:
       - name: Reject a manual run on a tag
         if: github.event_name == 'workflow_dispatch' && github.ref_type == 'tag'
@@ -141,14 +141,12 @@ jobs:
         id: changes
         shell: bash
         env:
-          BASE: ${{ github.event.pull_request.base.sha }}
           BASE_BRANCH: ${{ inputs.base }}
           GH_TOKEN: ${{ github.token }}
         run: |
           case "$GITHUB_EVENT_NAME" in
             pull_request)
-              git fetch -q --depth=1 origin "$BASE"
-              python3 scripts/ci/packages_release.py changes "$BASE"
+              python3 scripts/ci/packages_release.py changes HEAD^1
               ;;
             workflow_dispatch)
               base=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_BRANCH...$GITHUB_REF_NAME" --jq .merge_base_commit.sha)
@@ -157,7 +155,7 @@ jobs:
               ;;
             *)
               echo "haskell=true"
-              if [ "$GITHUB_REF_TYPE" = branch ]; then
+              if [ -n "$release_branch" ]; then
                 echo "kotlin=true"
                 echo "ios=true"
                 python3 scripts/ci/packages_release.py scopes
@@ -807,7 +805,7 @@ jobs:
   build-linux-push:
     name: "ubuntu-${{ matrix.os }}-${{ matrix.arch }} (CLI,Desktop), GHC: ${{ matrix.ghc }}"
     needs: [maybe-release, variables]
-    if: github.event_name == 'push'
+    if: needs.maybe-release.outputs.reduced != 'true' && github.event_name == 'push'
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: write
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index d40ef7d625..12fc5f5862 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -31,14 +31,12 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
 
       - name: Build plan
         id: plan
-        env:
-          BASE: ${{ github.event.pull_request.base.sha }}
-        run: |
-          git fetch -q --depth=1 origin "$BASE"
-          python3 scripts/ci/packages_release.py build-plan --base "$BASE" >> "$GITHUB_OUTPUT"
+        run: python3 scripts/ci/packages_release.py build-plan --base HEAD^1 >> "$GITHUB_OUTPUT"
 
   build:
     name: "build ${{ matrix.platform }}"
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 5fbe8293bc..7628eb1f9a 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -33,6 +33,7 @@ jobs:
           ./website/web.sh
 
       - name: Deploy
+        if: github.repository == 'simplex-chat/simplex-chat'
         uses: simplex-chat/actions-gh-pages@v3
         with:
           publish_dir: ./website/_site
diff --git a/scripts/ci/README.md b/scripts/ci/README.md
index a8cb147b01..e3096b71fe 100644
--- a/scripts/ci/README.md
+++ b/scripts/ci/README.md
@@ -4,7 +4,9 @@ Three workflows build the apps from a branch's own code and test them, only when
 
 ## Reduced build
 
-GitHub runs the reduced build of `build.yml` on a dispatch (workflow_dispatch) and on each push to a draft pull request. Once the pull request is marked ready for review, GitHub runs the full matrix.
+GitHub runs the reduced build of `build.yml` on a dispatch (workflow_dispatch), on each push to a draft pull request and on a push to master or stable in a fork. Once the pull request is marked ready for review, GitHub runs the full matrix, as on a push to master or stable in simplex-chat/simplex-chat.
+
+On a push to master or stable in a fork, the release steps and tests are skipped; build-linux saves the -O0 build caches, and on master the Docker image cache, that the fork's dispatches restore.
 
 On a draft pull request, the tests are selected by a fenced block with the info string `ci-tests` in the description, one hspec match pattern per line; the block is read at each push. `/` runs the whole suite; without a block, the reduced build runs no tests.
 
diff --git a/scripts/ci/run-tests.sh b/scripts/ci/run-tests.sh
index 327ff667cf..ef7c92112c 100755
--- a/scripts/ci/run-tests.sh
+++ b/scripts/ci/run-tests.sh
@@ -26,13 +26,13 @@ attempts=${ATTEMPTS:-1}
 while [ "$i" -le "$attempts" ]; do
   if "$@" "${args[@]}"; then
     break
-  else
+  elif [ "$i" -lt "$attempts" ]; then
     echo "Attempt $i failed, retrying..."
-    i=$((i + 1))
     sleep 1
   fi
+  i=$((i + 1))
 done
 if [ "$i" -gt "$attempts" ]; then
-  echo "All $attempts attempts failed."
+  echo "Attempt $attempts failed."
   exit 1
 fi