diff --git a/.github/workflows/extension_workflow_rollout.yml b/.github/workflows/extension_workflow_rollout.yml
index d8eae61c116f5d1544c0e1c12a51a23fbdfe9201..109f40c815dbf5222bef7b7d78d544f2b278c21f 100644
--- a/.github/workflows/extension_workflow_rollout.yml
+++ b/.github/workflows/extension_workflow_rollout.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch: {}
 jobs:
   fetch_extension_repos:
+    if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions') && github.ref == 'refs/heads/main'
     runs-on: namespace-profile-2x4-ubuntu-2404
     steps:
     - id: list-repos
diff --git a/tooling/xtask/src/tasks/workflows/extension_workflow_rollout.rs b/tooling/xtask/src/tasks/workflows/extension_workflow_rollout.rs
index bcee9be9a272079135c70ee45e5d16953eda2876..09e0b231ce79decb244b89a93cc8cf349623a290 100644
--- a/tooling/xtask/src/tasks/workflows/extension_workflow_rollout.rs
+++ b/tooling/xtask/src/tasks/workflows/extension_workflow_rollout.rs
@@ -9,7 +9,7 @@ use crate::tasks::workflows::steps::CheckoutStep;
 use crate::tasks::workflows::{
     extension_bump::{RepositoryTarget, generate_token},
     runners,
-    steps::{self, NamedJob, named},
+    steps::{self, DEFAULT_REPOSITORY_OWNER_GUARD, NamedJob, named},
     vars::{self, StepOutput},
 };
 
@@ -59,6 +59,9 @@ fn fetch_extension_repos() -> NamedJob {
     let (get_org_repositories, list_repos_output) = get_repositories();
 
     let job = Job::default()
+        .cond(Expression::new(format!(
+            "{DEFAULT_REPOSITORY_OWNER_GUARD} && github.ref == 'refs/heads/main'"
+        )))
         .runs_on(runners::LINUX_SMALL)
         .timeout_minutes(5u32)
         .outputs([("repos".to_owned(), list_repos_output.to_string())])