diff --git a/.github/workflows/test-linux.yaml b/.github/workflows/test-linux.yaml
index 0e1dd16..247fcc5 100644
--- a/.github/workflows/test-linux.yaml
+++ b/.github/workflows/test-linux.yaml
@@ -24,6 +24,7 @@ jobs:
           key: bazel
       - name: Login to Docker Hub
         uses: docker/login-action@v1
+        if: ${{ github.event_name != 'pull_request' }}
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -39,7 +40,6 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
       - uses: codecov/codecov-action@v2
         with:
-          token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
           files: ./coverage.txt
           directory: ./bazel-bin/
           verbose: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 96fe0a8..6347edf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,7 @@
 
 ### Fix
 - **bazel:** semi-hermitizing Go SDK
+- **ci:** disable steps that use secrets on PRs
 - **drone:** updating drone.yml signature
 - **linters:** addressing golangci-lint issues