diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 325461060..ae871eb4b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -344,6 +344,9 @@ jobs:
   privileged:
     needs: gomod-cache
     runs-on: ubuntu-24.04
+    # This job runs fork-PR code inside a --privileged container, so restrict it
+    # to runs on the tailscale/tailscale repo and never on 3p PRs.
+    if: github.repository == 'tailscale/tailscale'
     container:
       image: golang:latest
       options: --privileged