diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index c5e7e249..b74199f7 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -18,34 +18,37 @@ env:
 
   CAN_ACCESS_SECRETS: ${{ secrets.CAN_ACCESS_SECRETS }}
 
-  TYGER_AUTH_METHOD: "github"
+  TYGER_AUTH_METHOD: ${{ secrets.CAN_ACCESS_SECRETS != '' && 'github' || 'identity' }}
 
 jobs:
-  # If this is running a Dependabot PR or PR from a fork, it we won't have access to secrets
-  # nor will be be able to obtain a federated token to access Azure resources.
-  # Therefore, in those cases, we use hosted runners with managed identity to access Azure resources.
+  # Dependabot and fork PRs cannot access secrets, obtain Azure federated tokens, or publish to GHCR.
+  # In those cases, use self-hosted runners with managed identity and skip GHCR publication.
   # We only want to use those when necessary since they are a lot slower to come up, so this job
-  # determines what we should pass in to `runs-on` for jobs that access Azure resources.
-  # Also, this repo is configured to require approvals for all workflowd external contributors, and we
+  # selects Azure runners and determines GHCR publication eligibility.
+  # Also, this repo is configured to require workflow approvals for all external contributors, and we
   # should inspect the code in the PR before approving the run.
-  test-azure-needs-hosted-runner:
+  configure-ci:
     runs-on: ubuntu-latest
     outputs:
       AZURE_RUNS_ON_JSON: ${{ steps.set-vars.outputs.AZURE_RUNS_ON_JSON }}
       AZURE_RUNS_ON_WINDOWS_JSON: ${{ steps.set-vars.outputs.AZURE_RUNS_ON_WINDOWS_JSON }}
+      CAN_PUBLISH_GHCR: ${{ steps.set-vars.outputs.CAN_PUBLISH_GHCR }}
     steps:
       - id: set-vars
         run: |
           if [[ -n "${CAN_ACCESS_SECRETS:-}" ]]; then
             AZURE_RUNS_ON_JSON='"ubuntu-latest"'
             AZURE_RUNS_ON_WINDOWS_JSON='"windows-latest"'
+            CAN_PUBLISH_GHCR=true
           else
             AZURE_RUNS_ON_JSON='["self-hosted", "1ES.Pool=tyger-gh-1es"]'
             AZURE_RUNS_ON_WINDOWS_JSON='["self-hosted", "1ES.Pool=tyger-gh-1es-windows"]'
+            CAN_PUBLISH_GHCR=false
           fi
 
           echo "AZURE_RUNS_ON_JSON=$AZURE_RUNS_ON_JSON" >> "$GITHUB_OUTPUT"
           echo "AZURE_RUNS_ON_WINDOWS_JSON=$AZURE_RUNS_ON_WINDOWS_JSON" >> "$GITHUB_OUTPUT"
+          echo "CAN_PUBLISH_GHCR=$CAN_PUBLISH_GHCR" >> "$GITHUB_OUTPUT"
 
   unit-tests-and-format:
     runs-on: ubuntu-latest
@@ -126,10 +129,10 @@ jobs:
 
   build-images:
     needs:
-      - test-azure-needs-hosted-runner
+      - configure-ci
       - get-config
 
-    runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
+    runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}}
 
     env:
       EXPLICIT_IMAGE_TAG: ${{ needs.get-config.outputs.IMAGE_TAG }}
@@ -216,8 +219,11 @@ jobs:
           echo "DEVELOPER_CONFIG_BASE64=$developer_config_base64" >> "$GITHUB_ENV"
 
   publish-ghcr:
+    if: needs.configure-ci.outputs.CAN_PUBLISH_GHCR == 'true'
     runs-on: ubuntu-latest
-    needs: get-config
+    needs:
+      - get-config
+      - configure-ci
     defaults:
       run:
         shell: bash
@@ -247,7 +253,6 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - get-config
-      - publish-ghcr
     defaults:
       run:
         shell: bash
@@ -324,9 +329,9 @@ jobs:
 
   up:
     needs:
-      - test-azure-needs-hosted-runner
+      - configure-ci
       - get-config
-    runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
+    runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}}
     defaults:
       run:
         shell: bash
@@ -363,10 +368,10 @@ jobs:
 
   restore-scale-to-zero:
     needs:
-      - test-azure-needs-hosted-runner
+      - configure-ci
       - up
       - get-config
-    runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
+    runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}}
     defaults:
       run:
         shell: bash
@@ -394,10 +399,10 @@ jobs:
   integration-tests:
     name: integration-tests (${{ matrix.label }})
     needs:
-      - test-azure-needs-hosted-runner
+      - configure-ci
       - get-config
       - up
-    runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
+    runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}}
     env:
       TYGER_MIN_NODE_COUNT: "1"
       DO_NOT_BUILD_IMAGES: "true"
@@ -437,6 +442,7 @@ jobs:
   test-private-link-deployment:
     needs:
       - get-config
+      - build-images
     runs-on: ["self-hosted", "1ES.Pool=tyger-gh-1es-westus2"]
     defaults:
       run:
@@ -548,11 +554,11 @@ jobs:
 
   windows-smoke-tests:
     needs:
-      - test-azure-needs-hosted-runner
+      - configure-ci
       - get-config
       - build-binaries
       - up
-    runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_WINDOWS_JSON)}}
+    runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_WINDOWS_JSON)}}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -597,13 +603,13 @@ jobs:
     # Do not install from the unapproved GHCR registry for the long-running CI environment
     if: github.event_name == 'pull_request'
     needs:
-      - test-azure-needs-hosted-runner
+      - configure-ci
       - get-config
       - publish-ghcr
       - build-binaries
       - integration-tests
       - windows-smoke-tests
-    runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}}
+    runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}}
     defaults:
       run:
         shell: bash