diff --git a/.github/workflows/deploy-demo-on-release.yml b/.github/workflows/deploy-demo-on-release.yml
index 7b6ceb20..ba84c57d 100644
--- a/.github/workflows/deploy-demo-on-release.yml
+++ b/.github/workflows/deploy-demo-on-release.yml
@@ -15,6 +15,10 @@ concurrency:
 
 jobs:
   deploy:
+    # This is the maintainer's Demo deployment, not a default self-hosted
+    # deployment workflow. Forks and downstream repositories must configure
+    # their own deployment pipeline and credentials.
+    if: github.repository == 'tianma-if/edgeever'
     name: Build and deploy Demo Worker
     runs-on: ubuntu-latest
     timeout-minutes: 20
diff --git a/docs/cloudflare-workers-builds.md b/docs/cloudflare-workers-builds.md
index 82b465e5..2f8f7b1b 100644
--- a/docs/cloudflare-workers-builds.md
+++ b/docs/cloudflare-workers-builds.md
@@ -1,6 +1,6 @@
 # Cloudflare Workers Builds
 
-Cloudflare Workers Builds deploys EdgeEver whenever `main` changes. Cloudflare one-click deployment connects it automatically; CLI installations use local `bun run deploy:manual` only for first installation or emergency recovery. The official Demo Worker is additionally deployed by the `Deploy Demo on Release` workflow whenever a formal GitHub Release is published.
+Cloudflare Workers Builds deploys EdgeEver whenever `main` changes. Cloudflare one-click deployment connects it automatically; CLI installations use local `bun run deploy:manual` only for first installation or emergency recovery. The official Demo Worker is additionally deployed by the `Deploy Demo on Release` workflow whenever a formal GitHub Release is published. That workflow is restricted to the canonical `tianma-if/edgeever` repository; forks and self-hosted installations must use their own Cloudflare credentials and deployment configuration.
 
 ## Setup
 
@@ -41,6 +41,6 @@ If the command reports that no deployment API token is available, open **Worker*
 
 ## Updates and Troubleshooting
 
-After setup, every push to `main` makes Cloudflare install dependencies, check and build the app, apply new D1 migrations, deploy the Worker, and verify the result. For the official Demo Worker, publishing a formal Release triggers an immediate deployment from that Release tag through the `Deploy Demo on Release` GitHub workflow. Other self-hosted deployment repositories can use the **Update deployed EdgeEver** workflow, which checks upstream daily: `stable` follows formal Releases by default, while the repository variable `EDGE_EVER_UPDATE_CHANNEL=edge` follows upstream `main`. No Cloudflare deployment secrets or local redeployment are required in GitHub Actions.
+After setup, every push to `main` makes Cloudflare install dependencies, check and build the app, apply new D1 migrations, deploy the Worker, and verify the result. For the official Demo Worker, publishing a formal Release triggers an immediate deployment from that Release tag through the `Deploy Demo on Release` GitHub workflow; this workflow only runs in the canonical upstream repository. Other self-hosted deployment repositories can use the **Update deployed EdgeEver** workflow, which checks upstream daily: `stable` follows formal Releases by default, while the repository variable `EDGE_EVER_UPDATE_CHANNEL=edge` follows upstream `main`. No Cloudflare deployment secrets or local redeployment are required in GitHub Actions.
 
 If a build fails, inspect its log in the Worker **Deployments** tab. Rerun `bun run deploy:builds:setup` when instance settings change.
diff --git a/docs/cloudflare-workers-builds.zh-CN.md b/docs/cloudflare-workers-builds.zh-CN.md
index 74c2a776..74360195 100644
--- a/docs/cloudflare-workers-builds.zh-CN.md
+++ b/docs/cloudflare-workers-builds.zh-CN.md
@@ -1,6 +1,6 @@
 # Cloudflare Workers Builds 自动部署
 
-Cloudflare Workers Builds 会在 `main` 发生变化时自动部署 EdgeEver。Cloudflare 一键部署会自动完成连接；CLI 安装只在首次部署或紧急修复时使用本地 `bun run deploy:manual`。官方 Demo Worker 还会在 GitHub 正式 Release 发布后，由 `Deploy Demo on Release` 工作流立即部署。
+Cloudflare Workers Builds 会在 `main` 发生变化时自动部署 EdgeEver。Cloudflare 一键部署会自动完成连接；CLI 安装只在首次部署或紧急修复时使用本地 `bun run deploy:manual`。官方 Demo Worker 还会在 GitHub 正式 Release 发布后，由 `Deploy Demo on Release` 工作流立即部署。该工作流仅限官方 `tianma-if/edgeever` 仓库执行；Fork 或自托管实例必须使用自己的 Cloudflare 凭据和部署配置。
 
 ## 配置
 
@@ -41,6 +41,6 @@ EDGE_EVER_BUILDS_API_TOKEN=<token>
 
 ## 更新与排错
 
-配置完成后，任何推送到 `main` 的提交都会让 Cloudflare 安装依赖、检查并构建应用、执行新的 D1 migration、部署 Worker 并验证结果。官方 Demo Worker 在发布正式 Release 时，会通过 GitHub 的 `Deploy Demo on Release` 工作流从 Release 标签立即部署。其他自托管部署仓库可以使用 **Update deployed EdgeEver** 工作流每天检查上游：默认 `stable` 跟随正式 Release，设置 Repository Variable `EDGE_EVER_UPDATE_CHANNEL=edge` 后跟随上游 `main`。GitHub Actions 不需要保存 Cloudflare 部署 Secret，也不需要本地重新部署。
+配置完成后，任何推送到 `main` 的提交都会让 Cloudflare 安装依赖、检查并构建应用、执行新的 D1 migration、部署 Worker 并验证结果。官方 Demo Worker 在发布正式 Release 时，会通过 GitHub 的 `Deploy Demo on Release` 工作流从 Release 标签立即部署；该工作流只在官方上游仓库执行。其他自托管部署仓库可以使用 **Update deployed EdgeEver** 工作流每天检查上游：默认 `stable` 跟随正式 Release，设置 Repository Variable `EDGE_EVER_UPDATE_CHANNEL=edge` 后跟随上游 `main`。GitHub Actions 不需要保存 Cloudflare 部署 Secret，也不需要本地重新部署。
 
 构建失败时，在 Worker 的 **Deployments** 页面查看日志。实例配置变化后，重新执行 `bun run deploy:builds:setup`。