diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 349132b..76a4b26 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,6 +15,7 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: "ubuntu-latest"
+    timeout-minutes: 10
     permissions:
       security-events: write
     strategy:
@@ -41,6 +42,7 @@ jobs:
   zizmor:
     name: Zizmor
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       security-events: write
     steps:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ad3f399..247ba7a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -8,7 +8,11 @@ permissions:
 jobs:
   test:
     name: Test
+    # A pull request from a branch in this repository tests the same commit
+    # as the branch's push, so only pull requests from forks run here.
+    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix: