diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 698a34302c7..8f089205ab3 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -23,10 +23,32 @@ env:
   FORCE_COLOR: 1  # Request colored output from CLI tools supporting it
   MYPY_FORCE_COLOR: 1
   PY_COLORS: 1
+  UPSTREAM_REPOSITORY_ID: >-
+    13258039
 
 permissions: {}
+
 jobs:
 
+  pre-setup:
+    name: Pre-Setup global build settings
+    runs-on: ubuntu-latest
+    outputs:
+      upstream-repository-id: ${{ env.UPSTREAM_REPOSITORY_ID }}
+      release-requested: >-
+        ${{
+          (
+            github.event_name == 'push'
+            && github.ref_type == 'tag'
+          )
+          && true
+          || false
+        }}
+    steps:
+      - name: Dummy
+        run: |
+          echo "Pre-setup step"
+
   lint:
     permissions:
       contents: read # to fetch code (actions/checkout)
@@ -259,8 +281,11 @@ jobs:
 
   benchmark:
     name: Benchmark
-    needs: gen_llhttp
-
+    needs:
+    - gen_llhttp
+    - pre-setup  # transitive, for accessing settings
+    if: >-
+      needs.pre-setup.outputs.upstream-repository-id == github.repository_id
     runs-on: ubuntu-latest
     timeout-minutes: 9
     steps:
@@ -317,9 +342,10 @@ jobs:
   pre-deploy:
     name: Pre-Deploy
     runs-on: ubuntu-latest
-    needs: check
-    # Run only on pushing a tag
-    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
+    needs:
+    - check
+    - pre-setup  # transitive, for accessing settings
+    if: fromJSON(needs.pre-setup.outputs.release-requested)
     steps:
       - name: Dummy
         run: |
@@ -465,8 +491,13 @@ jobs:
 
   deploy:
     name: Deploy
-    needs: [build-tarball, build-wheels]
+    needs:
+    - build-tarball
+    - build-wheels
+    - pre-setup  # transitive, for accessing settings
     runs-on: ubuntu-latest
+    if: >-
+      needs.pre-setup.outputs.upstream-repository-id == github.repository_id
 
     permissions:
       contents: write  # IMPORTANT: mandatory for making GitHub Releases
diff --git a/CHANGES/11737.contrib.rst b/CHANGES/11737.contrib.rst
new file mode 100644
index 00000000000..2b793f41d6c
--- /dev/null
+++ b/CHANGES/11737.contrib.rst
@@ -0,0 +1,3 @@
+The benchmark CI job now runs only in the upstream repository -- by :user:`Cycloctane`.
+
+It used to always fail in forks, which this change fixed.