diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9eb2cd24..611d2c08 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,8 +31,10 @@ jobs:
       # This enables task distribution via Nx Cloud
       # Run this command as early as possible, before dependencies are installed
       # Learn more at https://nx.dev/ci/reference/nx-cloud-cli#npx-nxcloud-startcirun
-      # Uncomment this line to enable task distribution
-      - run: pnpm dlx nx-cloud start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="build"
+      # Only runs on pushes to main. PRs (including forks, which have no access
+      # to the Nx Cloud token) run Nx locally, so distribution is skipped.
+      - if: ${{ github.event_name == 'push' }}
+        run: pnpm dlx nx-cloud start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="build"
 
       # Cache node_modules
       - uses: actions/setup-node@v4
@@ -47,3 +49,7 @@ jobs:
       # - run: pnpm exec nx-cloud record -- echo Hello World
       # Nx Affected runs only tasks affected by the changes in this PR/commit. Learn more: https://nx.dev/ci/features/affected
       - run: pnpm exec nx affected -t lint test build
+        env:
+          # PRs run without Nx Cloud so they don't depend on the access token
+          # (unavailable to forks). Only pushes to main use the remote cache.
+          NX_NO_CLOUD: ${{ github.event_name == 'pull_request' }}