diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index cb291e7..84a84a5 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -24,27 +24,42 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HTTP_CLI_VERSION: v1.1.0
+      # Push to registries only on pushes to branches, never on pull_request
+      # events. Pull requests (especially Dependabot's) cannot read the repo
+      # secrets needed to authenticate, so they build for validation only.
+      PUSH: ${{ github.event_name != 'pull_request' }}
     steps:
       - uses: actions/checkout@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
       - name: Log in to Public ECR
+        if: github.event_name != 'pull_request'
         run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
       - name: Build and push base
         run: |
-          echo "${{ secrets.GHCR_PAT }}" > github_token
+          if [ "${{ env.PUSH }}" = "true" ]; then
+            echo "${{ secrets.GHCR_PAT }}" > github_token
+            OUTPUT_FLAG="--push"
+          else
+            # No secrets available on PRs; dummy secret file so the --secret
+            # mount resolves, and build without pushing.
+            echo "" > github_token
+            OUTPUT_FLAG="--output=type=cacheonly"
+          fi
           docker buildx build \
             --platform linux/arm64,linux/amd64 \
             --provenance=false \
@@ -53,7 +68,7 @@ jobs:
             --target base \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:base \
             --tag public.ecr.aws/l9f6r9f5/lambda-shell-runtime:base \
-            --push \
+            $OUTPUT_FLAG \
             .
         env:
           GITHUB_TOKEN: ${{ secrets.GHCR_PAT }}
@@ -119,14 +134,17 @@ jobs:
           fi
           echo "Detected VERSION: $VERSION"
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
       - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
         run: echo "${{ secrets.GHCR_PAT }}" | docker login ghcr.io -u skunxicat --password-stdin
       - name: Log in to Public ECR
+        if: github.event_name != 'pull_request'
         run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
       - name: Build and push images
         run: |