diff --git a/.github/workflows/close-stale-issues.yml b/.github/workflows/close-stale-issues.yml
index 5924ccd8b727e..61fa5967b2722 100644
--- a/.github/workflows/close-stale-issues.yml
+++ b/.github/workflows/close-stale-issues.yml
@@ -8,6 +8,8 @@ on:
 
 jobs:
   cleanup:
+    # this workflow will always fail in forks; bail if this isn't running in the upstream
+    if: github.repository == 'aws/aws-cdk'
     permissions:
       issues: write
       contents: read
diff --git a/.github/workflows/close-stale-prs.yml b/.github/workflows/close-stale-prs.yml
index d8543bc1725df..4fe804c13ad34 100644
--- a/.github/workflows/close-stale-prs.yml
+++ b/.github/workflows/close-stale-prs.yml
@@ -5,6 +5,8 @@ on:
   workflow_dispatch:
 jobs:
   close-stale-prs:
+    # this workflow will always fail in forks; bail if this isn't running in the upstream
+    if: github.repository == 'aws/aws-cdk'
     permissions:
       pull-requests: write
     runs-on: ubuntu-latest
diff --git a/.github/workflows/handle-stale-discussions.yml b/.github/workflows/handle-stale-discussions.yml
index 2b89f2da15f21..7a5ad637905f9 100644
--- a/.github/workflows/handle-stale-discussions.yml
+++ b/.github/workflows/handle-stale-discussions.yml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   handle-stale-discussions:
+    # this workflow will always fail in forks; bail if this isn't running in the upstream
+    if: github.repository == 'aws/aws-cdk'
     name: Handle stale discussions
     runs-on: ubuntu-latest
     permissions:
@@ -15,4 +17,4 @@ jobs:
       - name: Stale discussions action
         uses: aws-github-ops/handle-stale-discussions@v1
         env:
-          GITHUB_TOKEN:  ${{secrets.GITHUB_TOKEN}}
\ No newline at end of file
+          GITHUB_TOKEN:  ${{secrets.GITHUB_TOKEN}}