diff --git a/.github/workflows/analyze-ci-failure.lock.yml b/.github/workflows/analyze-ci-failure.lock.yml
index 85dfe01e833..66da9c35947 100644
--- a/.github/workflows/analyze-ci-failure.lock.yml
+++ b/.github/workflows/analyze-ci-failure.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0b2bb2b0399c77551480ef59644dd3a084e2cee3f4d93bcc1a00bdf802b02057","body_hash":"1c62bfd447384ce250986e55630d7cf0b661087462c7d085cf48c63684110174","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"58c705b7392097417ceda22c1568694f84f017fb7b4a34430d0ecbb29713c100","body_hash":"1c62bfd447384ce250986e55630d7cf0b661087462c7d085cf48c63684110174","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["missing_data","missing_tool","noop","publish_data","rerun_failed_jobs"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -1180,7 +1180,7 @@ jobs:
   collect-data:
     needs: activation
     if: >
-      github.repository_owner == 'microsoft' && (
+      github.repository == 'microsoft/aspire' && (
       github.event_name == 'workflow_dispatch'
       || (
       github.event.workflow_run.conclusion == 'failure'
diff --git a/.github/workflows/analyze-ci-failure.md b/.github/workflows/analyze-ci-failure.md
index 6b5fcb4f046..71d5eb65d1a 100644
--- a/.github/workflows/analyze-ci-failure.md
+++ b/.github/workflows/analyze-ci-failure.md
@@ -24,7 +24,7 @@ jobs:
   collect-data:
     runs-on: ubuntu-latest
     if: >-
-      github.repository_owner == 'microsoft'
+      github.repository == 'microsoft/aspire'
       && (
         github.event_name == 'workflow_dispatch'
         || (
diff --git a/.github/workflows/auto-rerun-outerloop-failures.yml b/.github/workflows/auto-rerun-outerloop-failures.yml
index b4b6dcfc67b..5ede5ed2058 100644
--- a/.github/workflows/auto-rerun-outerloop-failures.yml
+++ b/.github/workflows/auto-rerun-outerloop-failures.yml
@@ -31,7 +31,7 @@ jobs:
     # them would mask genuine breakage in exactly the PRs that change outerloop CI.
     if: >-
       ${{
-          github.repository_owner == 'microsoft' &&
+          github.repository == 'microsoft/aspire' &&
           github.event.workflow_run.event != 'pull_request' &&
           github.event.workflow_run.conclusion == 'failure' &&
           github.event.workflow_run.run_attempt <= 3
diff --git a/.github/workflows/auto-rerun-transient-ci-failures.yml b/.github/workflows/auto-rerun-transient-ci-failures.yml
index 561e7450820..c5febcd3d95 100644
--- a/.github/workflows/auto-rerun-transient-ci-failures.yml
+++ b/.github/workflows/auto-rerun-transient-ci-failures.yml
@@ -31,7 +31,7 @@ jobs:
     name: Analyze transient CI failures
     if: >-
       ${{
-          github.repository_owner == 'microsoft' &&
+          github.repository == 'microsoft/aspire' &&
           (github.event_name == 'workflow_dispatch' ||
            (github.event.workflow_run.event == 'pull_request' &&
             github.event.workflow_run.conclusion == 'failure' &&
diff --git a/.github/workflows/backmerge-release.yml b/.github/workflows/backmerge-release.yml
index 5c21c72eb7a..330a9c43790 100644
--- a/.github/workflows/backmerge-release.yml
+++ b/.github/workflows/backmerge-release.yml
@@ -14,7 +14,7 @@ jobs:
   backmerge:
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
 
     steps:
       - name: Generate GitHub App Token
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index b3988ac5b95..cc17e4aba7b 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -20,7 +20,7 @@ jobs:
   cleanup:
     if: >-
       github.event_name == 'schedule' &&
-      contains(fromJSON('["dotnet", "microsoft"]'), github.repository_owner)
+      github.repository == 'microsoft/aspire'
     runs-on: ubuntu-latest
     permissions:
       actions: write
@@ -62,7 +62,7 @@ jobs:
   backport:
     if: >-
       github.event_name == 'issue_comment' &&
-      contains(fromJSON('["dotnet", "microsoft"]'), github.repository_owner) &&
+      github.repository == 'microsoft/aspire' &&
       github.event.issue.pull_request != '' &&
       contains(github.event.comment.body, '/backport to')
     runs-on: ubuntu-latest
diff --git a/.github/workflows/build-cli-e2e-image.yml b/.github/workflows/build-cli-e2e-image.yml
index 3efc0a4570d..60337f5b15b 100644
--- a/.github/workflows/build-cli-e2e-image.yml
+++ b/.github/workflows/build-cli-e2e-image.yml
@@ -30,6 +30,7 @@ env:
 jobs:
   build:
     name: Build CLI E2E Docker image
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ github.repository_owner == 'microsoft' && '8-core-ubuntu-latest' || 'ubuntu-latest' }}
     timeout-minutes: 45
 
diff --git a/.github/workflows/build-cli-native-archives.yml b/.github/workflows/build-cli-native-archives.yml
index dd942b3bcfc..f3b7d7ee7bc 100644
--- a/.github/workflows/build-cli-native-archives.yml
+++ b/.github/workflows/build-cli-native-archives.yml
@@ -31,6 +31,7 @@ jobs:
 
   build_cli_archives:
     name: Build CLI (${{ matrix.targets.rids }})
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ matrix.targets.runner }}
     strategy:
       matrix:
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 2cb9094dfc4..c619f7fb853 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -10,6 +10,7 @@ on:
 jobs:
   build_packages:
     name: Build packages
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: 8-core-ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4c71aab8963..633b74626ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
   actionlint:
     name: Lint handwritten workflows
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -54,7 +54,7 @@ jobs:
   prepare_for_ci:
     runs-on: ubuntu-latest
     name: Prepare for CI
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     outputs:
       skip_workflow: ${{ (steps.check_for_changes.outputs.no_changes == 'true' || steps.check_for_changes.outputs.only_changed == 'true') && 'true' || 'false' }}
       VERSION_SUFFIX_OVERRIDE: ${{ steps.compute_version_suffix.outputs.VERSION_SUFFIX_OVERRIDE }}
@@ -114,7 +114,7 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
-    if: ${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}
     with:
       versionOverrideArg: ${{ needs.prepare_for_ci.outputs.VERSION_SUFFIX_OVERRIDE }}
       extensionVersionOverride: ${{ needs.prepare_for_ci.outputs.EXTENSION_VERSION_OVERRIDE }}
@@ -143,7 +143,7 @@ jobs:
     name: Stabilization Check
     runs-on: 8-core-ubuntu-latest
     needs: [prepare_for_ci]
-    if: ${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' && github.event_name == 'pull_request' && needs.prepare_for_ci.outputs.STABILIZATION_ENABLED == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' && github.event_name == 'pull_request' && needs.prepare_for_ci.outputs.STABILIZATION_ENABLED == 'true' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -205,7 +205,7 @@ jobs:
 
   # This job is used for branch protection. It fails if any of the dependent jobs failed
   results:
-    if: ${{ always() && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Final Results
     needs: [actionlint, prepare_for_ci, tests, stabilization_check]
@@ -244,7 +244,7 @@ jobs:
   ci_failure_tracker:
     name: Track CI Failure
     needs: [actionlint, prepare_for_ci, tests, stabilization_check]
-    if: ${{ always() && github.event_name == 'push' && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.event_name == 'push' && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read   # checkout to require the local .js modules
diff --git a/.github/workflows/cli-starter-validation.yml b/.github/workflows/cli-starter-validation.yml
index f04360d62c1..1027ca349c9 100644
--- a/.github/workflows/cli-starter-validation.yml
+++ b/.github/workflows/cli-starter-validation.yml
@@ -32,6 +32,7 @@ permissions:
 jobs:
   validate:
     name: Validate
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ inputs.runner }}
     # Shared budget for every caller of this reusable workflow. The validation script can spend
     # up to four startup waits (run + start for two templates) and three resource waits, which is
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index efe80096467..3fc61120603 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -14,6 +14,7 @@ on:
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
   copilot-setup-steps:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ github.repository_owner == 'microsoft' && '8-core-ubuntu-latest' || 'ubuntu-latest' }}
 
     permissions:
diff --git a/.github/workflows/deployment-cleanup.yml b/.github/workflows/deployment-cleanup.yml
index 7d9d86e3807..6b3490aa12c 100644
--- a/.github/workflows/deployment-cleanup.yml
+++ b/.github/workflows/deployment-cleanup.yml
@@ -39,7 +39,7 @@ jobs:
   cleanup:
     name: Cleanup Azure Resources
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     environment: deployment-testing
 
     steps:
diff --git a/.github/workflows/deployment-test-command.yml b/.github/workflows/deployment-test-command.yml
index dd42328593c..02ff2321cdc 100644
--- a/.github/workflows/deployment-test-command.yml
+++ b/.github/workflows/deployment-test-command.yml
@@ -23,7 +23,7 @@ jobs:
       ${{
         startsWith(github.event.comment.body, '/deployment-test') &&
         github.event.issue.pull_request &&
-        github.repository_owner == 'microsoft'
+        github.repository == 'microsoft/aspire'
       }}
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/deployment-tests.yml b/.github/workflows/deployment-tests.yml
index f13ffcec879..b812a745c6e 100644
--- a/.github/workflows/deployment-tests.yml
+++ b/.github/workflows/deployment-tests.yml
@@ -40,7 +40,7 @@ jobs:
   notify-start:
     name: Notify PR
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' && inputs.pr_number != '' }}
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.pr_number != '' }}
     permissions:
       pull-requests: write
     steps:
@@ -67,7 +67,7 @@ jobs:
   enumerate:
     name: Enumerate Tests
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read
     outputs:
@@ -114,7 +114,7 @@ jobs:
   build:
     name: Build
     runs-on: 8-core-ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read
     steps:
@@ -641,7 +641,7 @@ jobs:
     name: Create Issue on Failure
     needs: [deploy-test]
     runs-on: ubuntu-latest
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read   # checkout to require the local .js modules
       issues: write
diff --git a/.github/workflows/dogfood-comment.yml b/.github/workflows/dogfood-comment.yml
index 97faf6c42ab..7f66d943074 100644
--- a/.github/workflows/dogfood-comment.yml
+++ b/.github/workflows/dogfood-comment.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   add-dogfood-comment:
     # Only run on the dotnet org to avoid running on forks
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
diff --git a/.github/workflows/extension-changelog-finalized.yml b/.github/workflows/extension-changelog-finalized.yml
index 8c975a791c7..55dafdbc890 100644
--- a/.github/workflows/extension-changelog-finalized.yml
+++ b/.github/workflows/extension-changelog-finalized.yml
@@ -13,6 +13,7 @@ permissions:
 jobs:
   extension_changelog_finalized:
     name: Extension changelog finalized
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/extension-e2e-tests.yml b/.github/workflows/extension-e2e-tests.yml
index 460707ab6a3..7db994ae4c9 100644
--- a/.github/workflows/extension-e2e-tests.yml
+++ b/.github/workflows/extension-e2e-tests.yml
@@ -5,6 +5,7 @@ on:
 
 jobs:
   verify_extester_feed:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: Verify ExTester internal feed availability
     runs-on: ubuntu-latest
     env:
@@ -72,6 +73,7 @@ jobs:
         run: node scripts/run-e2e.js --verify-extester-feed
 
   extension_e2e:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: VS Code extension E2E (${{ matrix.name }}, ${{ matrix.shardName }})
     needs: verify_extester_feed
     runs-on: ${{ matrix.runner }}
diff --git a/.github/workflows/extension-unit-tests.yml b/.github/workflows/extension-unit-tests.yml
index 554d12b244e..e136f2f076a 100644
--- a/.github/workflows/extension-unit-tests.yml
+++ b/.github/workflows/extension-unit-tests.yml
@@ -18,6 +18,7 @@ permissions:
 jobs:
   extension_tests_win:
     name: Run VS Code extension unit tests (Windows)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: windows-latest
     env:
       NPM_REGISTRY: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
diff --git a/.github/workflows/generate-api-diffs.yml b/.github/workflows/generate-api-diffs.yml
index ca1593a1bec..9359ce75220 100644
--- a/.github/workflows/generate-api-diffs.yml
+++ b/.github/workflows/generate-api-diffs.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/generate-ats-diffs.yml b/.github/workflows/generate-ats-diffs.yml
index fb5707c0a2c..3a83742181c 100644
--- a/.github/workflows/generate-ats-diffs.yml
+++ b/.github/workflows/generate-ats-diffs.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml
index a125abebd27..e0e9b436bce 100644
--- a/.github/workflows/locker.yml
+++ b/.github/workflows/locker.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   main:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - name: Checkout Actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
index 05356ef1801..756685d3d13 100644
--- a/.github/workflows/markdownlint.yml
+++ b/.github/workflows/markdownlint.yml
@@ -12,7 +12,7 @@ jobs:
   lint:
 
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/milestone-changelog.lock.yml b/.github/workflows/milestone-changelog.lock.yml
index 728e4c02c9e..c3b4aa897a4 100644
--- a/.github/workflows/milestone-changelog.lock.yml
+++ b/.github/workflows/milestone-changelog.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0302dcdec3e71a48a3e67e57c87e9a4c35fec3b6633ebdcbc2b7b9140b1d1cff","body_hash":"75a78861feb3dbf57cda665b7587eec5ef46a3999e2a20337ba00a8f8875284a","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2517472aa8e191e8099a2ea79ad07e27e7945b24b40a5349b058bf8200cfecc2","body_hash":"75a78861feb3dbf57cda665b7587eec5ef46a3999e2a20337ba00a8f8875284a","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["missing_data","missing_tool","noop","publish"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -340,7 +340,7 @@ jobs:
     needs:
       - activation
       - fetch-data
-    if: github.repository_owner == 'microsoft' && needs.fetch-data.outputs.has-work == 'true'
+    if: github.repository == 'microsoft/aspire' && needs.fetch-data.outputs.has-work == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -1645,6 +1645,7 @@ jobs:
 
   fetch-data:
     needs: activation
+    if: github.repository == 'microsoft/aspire'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/milestone-changelog.md b/.github/workflows/milestone-changelog.md
index 0b81ea62887..bb9da239833 100644
--- a/.github/workflows/milestone-changelog.md
+++ b/.github/workflows/milestone-changelog.md
@@ -54,6 +54,7 @@ on:
 
 jobs:
   fetch-data:
+    if: github.repository == 'microsoft/aspire'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -318,7 +319,7 @@ jobs:
           name: changelog-data
           path: /tmp/gh-aw/
 
-if: github.repository_owner == 'microsoft' && needs.fetch-data.outputs.has-work == 'true'
+if: github.repository == 'microsoft/aspire' && needs.fetch-data.outputs.has-work == 'true'
 
 permissions:
   contents: read
diff --git a/.github/workflows/monitor-scheduled-workflows.yml b/.github/workflows/monitor-scheduled-workflows.yml
index 575c72fc284..557edd29910 100644
--- a/.github/workflows/monitor-scheduled-workflows.yml
+++ b/.github/workflows/monitor-scheduled-workflows.yml
@@ -33,7 +33,7 @@ concurrency:
 jobs:
   monitor:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/native-dashboard-validation.yml b/.github/workflows/native-dashboard-validation.yml
index faa6f2fc5c5..bb98982afa7 100644
--- a/.github/workflows/native-dashboard-validation.yml
+++ b/.github/workflows/native-dashboard-validation.yml
@@ -21,6 +21,7 @@ permissions:
 jobs:
   validate:
     name: Validate
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
diff --git a/.github/workflows/polyglot-validation.yml b/.github/workflows/polyglot-validation.yml
index b7ac2359fc9..98890ab1991 100644
--- a/.github/workflows/polyglot-validation.yml
+++ b/.github/workflows/polyglot-validation.yml
@@ -17,6 +17,7 @@ env:
 jobs:
   validate_python:
     name: Python SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -72,6 +73,7 @@ jobs:
 
   validate_go:
     name: Go SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -127,6 +129,7 @@ jobs:
 
   validate_java:
     name: Java SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -182,6 +185,7 @@ jobs:
 
   validate_rust:
     name: Rust SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     # Rust SDK has known issues - don't fail the workflow
     continue-on-error: true
@@ -239,6 +243,7 @@ jobs:
 
   validate_typescript:
     name: TypeScript SDK Validation (Node ${{ matrix.node-version }}.x)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -298,7 +303,7 @@ jobs:
             polyglot-typescript-node-${{ matrix.node-version }}
 
   results:
-    if: always()
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Polyglot Validation Results
     needs: [validate_python, validate_go, validate_java, validate_rust, validate_typescript]
diff --git a/.github/workflows/pr-docs-check.lock.yml b/.github/workflows/pr-docs-check.lock.yml
index 2ac477372cf..c5b8b5ae36a 100644
--- a/.github/workflows/pr-docs-check.lock.yml
+++ b/.github/workflows/pr-docs-check.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f46e10de87d170af1d9534d8948e1d73d943e003cace3d0d46816e392f4aad73","body_hash":"286d2cb44cc68daab8b4a9302115444e05e47610162a50b7810ab0e650fd5282","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f86fe79184975910d9c148e901f9b6e56eb897d7dc3451b2bf8b49ada978ffbb","body_hash":"286d2cb44cc68daab8b4a9302115444e05e47610162a50b7810ab0e650fd5282","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["ASPIRE_BOT_APP_ID","ASPIRE_BOT_PRIVATE_KEY","GH_AW_CI_TRIGGER_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/create-github-app-token","sha":"bcd2ba49218906704ab6c1aa796996da409d3eb1","version":"v3.2.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"has_pull_request":true,"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_pull_request","missing_data","missing_tool","noop","notify_source_pr"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -104,7 +104,7 @@ jobs:
     needs: pre_activation
     if: >
       needs.pre_activation.outputs.activated == 'true' && ((((github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch') &&
-      github.repository_owner == 'microsoft') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)) &&
+      github.repository == 'microsoft/aspire') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || github.event.pull_request.stack == null ||
       github.event.pull_request.stack.position == github.event.pull_request.stack.size))
     runs-on: ubuntu-slim
@@ -2081,7 +2081,7 @@ jobs:
 
   pre_activation:
     if: >
-      (((github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch') && github.repository_owner == 'microsoft') &&
+      (((github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch') && github.repository == 'microsoft/aspire') &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || github.event.pull_request.stack == null ||
       github.event.pull_request.stack.position == github.event.pull_request.stack.size)
diff --git a/.github/workflows/pr-docs-check.md b/.github/workflows/pr-docs-check.md
index f46767b66cf..f03f126c697 100644
--- a/.github/workflows/pr-docs-check.md
+++ b/.github/workflows/pr-docs-check.md
@@ -29,7 +29,7 @@ on:
 
 if: >-
   (github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch')
-  && github.repository_owner == 'microsoft'
+  && github.repository == 'microsoft/aspire'
 
 # Cap the number of agent turns. `max-turns` is the supported field; the older
 # `max-runs` alias is deprecated and rejected under strict compilation. It
diff --git a/.github/workflows/prepare-installer-artifacts.yml b/.github/workflows/prepare-installer-artifacts.yml
index c7ff541bddc..bb5ee8a1fbc 100644
--- a/.github/workflows/prepare-installer-artifacts.yml
+++ b/.github/workflows/prepare-installer-artifacts.yml
@@ -9,6 +9,7 @@ on:
 
 jobs:
   prepare_installer_artifacts:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: Prepare ${{ inputs.installer == 'winget' && 'WinGet manifests' || 'Homebrew cask' }}
     runs-on: ${{ inputs.installer == 'winget' && 'windows-latest' || 'macos-latest' }}
     steps:
diff --git a/.github/workflows/refresh-manifests.yml b/.github/workflows/refresh-manifests.yml
index 0544645ddd9..400fab81db9 100644
--- a/.github/workflows/refresh-manifests.yml
+++ b/.github/workflows/refresh-manifests.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: windows-latest # Using Windows because the script uses PowerShell and build.cmd
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/release-github-tasks.yml b/.github/workflows/release-github-tasks.yml
index 4ab8f0b3c7d..e8b307a3da9 100644
--- a/.github/workflows/release-github-tasks.yml
+++ b/.github/workflows/release-github-tasks.yml
@@ -97,6 +97,7 @@ jobs:
   # `skip_*` inputs so partial-failure re-runs still behave the same way.
   release:
     name: Release Tasks
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     # Authorization uses github.token; release operations use the App token.
     permissions:
@@ -418,7 +419,7 @@ jobs:
   merge-pr:
     name: Create Merge-Back PR
     needs: release
-    if: inputs.skip_merge_pr != true
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.skip_merge_pr != true }}
     runs-on: ubuntu-latest
     # Every GitHub operation in this job uses the App token minted below.
     permissions: {}
@@ -507,7 +508,7 @@ jobs:
   baseline-pr:
     name: Create Baseline Version Branch/PR
     needs: release
-    if: inputs.skip_baseline_pr != true && inputs.is_prerelease != true
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.skip_baseline_pr != true && inputs.is_prerelease != true }}
     runs-on: ubuntu-latest
     # Every GitHub operation in this job uses the App token minted below.
     permissions: {}
@@ -663,7 +664,7 @@ jobs:
   summary:
     name: Summary
     needs: [release, merge-pr, baseline-pr]
-    if: always()
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Print Summary
diff --git a/.github/workflows/reproduce-flaky-tests.yml b/.github/workflows/reproduce-flaky-tests.yml
index fd002aaab45..694d9e47192 100644
--- a/.github/workflows/reproduce-flaky-tests.yml
+++ b/.github/workflows/reproduce-flaky-tests.yml
@@ -45,6 +45,7 @@ jobs:
 
   setup:
     name: Generate matrix
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.generate.outputs.matrix }}
@@ -127,7 +128,7 @@ jobs:
   build_cli_e2e_image:
     name: Build CLI E2E Docker image
     needs: setup
-    if: ${{ needs.setup.outputs.is_cli_e2e == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.setup.outputs.is_cli_e2e == 'true' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
 
   reproduce:
@@ -135,6 +136,7 @@ jobs:
     needs: [setup, build_cli_e2e_image]
     if: >-
       ${{
+        github.repository == 'microsoft/aspire' &&
         !cancelled() &&
         needs.setup.result == 'success' &&
         (needs.build_cli_e2e_image.result == 'success' || needs.build_cli_e2e_image.result == 'skipped')
@@ -388,10 +390,11 @@ jobs:
           if-no-files-found: ignore
 
   results:
-    if: always()
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Reproduce Results
     needs: [reproduce]
+    permissions: {}
     steps:
       - name: Summary
         shell: bash
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 1ca54528c5f..b25d04a2dc9 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -47,9 +47,13 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 jobs:
 
   test:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     name: ${{ inputs.testShortName }} (${{ inputs.os }})
diff --git a/.github/workflows/scratch-cli-platform-smoke.yml b/.github/workflows/scratch-cli-platform-smoke.yml
index 415aa8a73e0..75847be9b0c 100644
--- a/.github/workflows/scratch-cli-platform-smoke.yml
+++ b/.github/workflows/scratch-cli-platform-smoke.yml
@@ -21,6 +21,7 @@ run-name: "CLI platform smoke tests for PR #${{ inputs.pr_number }} (run ${{ inp
 jobs:
   source:
     name: Resolve artifact source
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     outputs:
       sha: ${{ steps.source.outputs.sha }}
@@ -56,6 +57,7 @@ jobs:
   smoke:
     name: ${{ matrix.name }}
     needs: source
+    if: ${{ github.repository == 'microsoft/aspire' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/specialized-test-runner.yml b/.github/workflows/specialized-test-runner.yml
index 46afeb693f8..63256d42484 100644
--- a/.github/workflows/specialized-test-runner.yml
+++ b/.github/workflows/specialized-test-runner.yml
@@ -38,7 +38,7 @@ jobs:
   generate_tests_matrix:
     name: Generate test runsheet
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     outputs:
       runsheet: ${{ steps.inject_properties.outputs.runsheet }}
       requiresNugets: ${{ steps.check_nugets.outputs.requiresNugets }}
@@ -124,19 +124,19 @@ jobs:
   build_packages:
     name: Build packages
     needs: [generate_tests_matrix]
-    if: ${{ github.repository_owner == 'microsoft' && needs.generate_tests_matrix.outputs.requiresNugets == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.generate_tests_matrix.outputs.requiresNugets == 'true' }}
     uses: ./.github/workflows/build-packages.yml
 
   build_cli_archives:
     name: Build native CLI archives
     needs: [generate_tests_matrix]
-    if: ${{ github.repository_owner == 'microsoft' && (needs.generate_tests_matrix.outputs.requiresNugets == 'true' || needs.generate_tests_matrix.outputs.requiresCliArchive == 'true') }}
+    if: ${{ github.repository == 'microsoft/aspire' && (needs.generate_tests_matrix.outputs.requiresNugets == 'true' || needs.generate_tests_matrix.outputs.requiresCliArchive == 'true') }}
     uses: ./.github/workflows/build-cli-native-archives.yml
 
   build_cli_e2e_image:
     name: Build CLI E2E Docker image
     needs: [generate_tests_matrix]
-    if: ${{ github.repository_owner == 'microsoft' && needs.generate_tests_matrix.outputs.requiresCliArchive == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.generate_tests_matrix.outputs.requiresCliArchive == 'true' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
 
   run_tests:
@@ -152,13 +152,15 @@ jobs:
     # We still require generate_tests_matrix and build_packages to succeed.
     if: >-
       ${{
-        github.repository_owner == 'microsoft' &&
+        github.repository == 'microsoft/aspire' &&
         !cancelled() &&
         needs.generate_tests_matrix.result == 'success' &&
         (needs.build_packages.result == 'success' || needs.build_packages.result == 'skipped') &&
         (needs.build_cli_e2e_image.result == 'success' || needs.build_cli_e2e_image.result == 'skipped')
       }}
     uses: ./.github/workflows/run-tests.yml
+    permissions:
+      contents: read
     with:
       testShortName: ${{ matrix.tests.project }}
       properties: ${{ toJson(matrix.tests.properties) }}
@@ -170,10 +172,12 @@ jobs:
 
 
   results:
-    if: ${{ always() && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Final Results
     needs: [generate_tests_matrix, build_packages, build_cli_archives, build_cli_e2e_image, run_tests]
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
diff --git a/.github/workflows/tests-daily-smoke.yml b/.github/workflows/tests-daily-smoke.yml
index b95a693cee9..2a493b19a6c 100644
--- a/.github/workflows/tests-daily-smoke.yml
+++ b/.github/workflows/tests-daily-smoke.yml
@@ -28,6 +28,7 @@ permissions:
 jobs:
   build_cli_e2e_image:
     name: Build CLI E2E Docker image
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
     with:
       includePolyglotImages: false
@@ -35,6 +36,7 @@ jobs:
   smoke-test:
     name: CLI Smoke Test (${{ inputs.quality || 'dev' }})
     needs: build_cli_e2e_image
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
 
@@ -251,7 +253,7 @@ jobs:
     name: Create Issue on Failure
     needs: [smoke-test]
     runs-on: ubuntu-latest
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read   # checkout to require the local .js modules
       actions: read    # download-artifact
diff --git a/.github/workflows/tests-outerloop.yml b/.github/workflows/tests-outerloop.yml
index 35d6f2ca678..a61b0b68605 100644
--- a/.github/workflows/tests-outerloop.yml
+++ b/.github/workflows/tests-outerloop.yml
@@ -39,7 +39,10 @@ concurrency:
 
 jobs:
   outerloop_tests:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
+    permissions:
+      contents: read
     with:
       testRunnerName: "OuterloopTestRunsheetBuilder"
       attributeName: "OuterloopTest"
@@ -55,7 +58,7 @@ jobs:
   report_failures:
     name: Report failures
     needs: [outerloop_tests]
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read   # checkout to require the local .js modules
diff --git a/.github/workflows/tests-quarantine.yml b/.github/workflows/tests-quarantine.yml
index 121e3320adc..b27710a5051 100644
--- a/.github/workflows/tests-quarantine.yml
+++ b/.github/workflows/tests-quarantine.yml
@@ -39,7 +39,10 @@ concurrency:
 
 jobs:
   quarantine_tests:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
+    permissions:
+      contents: read
     with:
       testRunnerName: "QuarantinedTestRunsheetBuilder"
       attributeName: "QuarantinedTest"
@@ -60,7 +63,7 @@ jobs:
   report_infra_failure:
     name: Report infra failure
     needs: [quarantine_tests]
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read   # checkout to require the local .js modules
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2c8fc4a1af7..4e2f6fbdfe4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -18,6 +18,7 @@ permissions:
 jobs:
   setup_for_tests:
     name: Setup for tests
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     # This job checks out and runs PR-authored code (SelectTests, the test build), so it is kept at
     # contents:read with no pull-requests:write. The selection comment is posted from the
@@ -254,12 +255,14 @@ jobs:
 
   build_packages:
     name: Build packages
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-packages.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
 
   build_cli_archive_linux:
     name: Build native CLI archive (Linux)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -267,6 +270,7 @@ jobs:
 
   build_cli_archive_linux_arm64:
     name: Build native CLI archive (Linux ARM64)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -278,6 +282,7 @@ jobs:
   # without waiting for the slower Windows/macOS builds.
   build_cli_archive_windows:
     name: Build native CLI archive (Windows)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -285,6 +290,7 @@ jobs:
 
   build_cli_archive_windows_arm64:
     name: Build native CLI archive (Windows ARM64)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -293,6 +299,7 @@ jobs:
 
   build_cli_archive_macos:
     name: Build native CLI archive (macOS)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -300,6 +307,7 @@ jobs:
 
   build_cli_archive_macos_x64:
     name: Build native CLI archive (macOS x64)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -481,7 +489,7 @@ jobs:
   cli_starter_validation_linux_x64:
     name: Aspire CLI Starter Validation (Ubuntu x64)
     needs: [setup_for_tests, build_packages, build_cli_archive_linux]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: ubuntu-latest
@@ -495,7 +503,7 @@ jobs:
   cli_starter_validation_linux_arm64:
     name: Aspire CLI Starter Validation (Ubuntu ARM64)
     needs: [setup_for_tests, build_packages, build_cli_archive_linux_arm64]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: ubuntu-24.04-arm
@@ -509,7 +517,7 @@ jobs:
   cli_starter_validation_windows_x64:
     name: Aspire CLI Starter Validation (Windows x64)
     needs: [setup_for_tests, build_packages, build_cli_archive_windows]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: windows-latest
@@ -523,7 +531,7 @@ jobs:
   cli_starter_validation_windows_arm64:
     name: Aspire CLI Starter Validation (Windows ARM64)
     needs: [setup_for_tests, build_packages, build_cli_archive_windows_arm64]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: windows-11-arm
@@ -537,7 +545,7 @@ jobs:
   cli_starter_validation_macos_x64:
     name: Aspire CLI Starter Validation (macOS x64)
     needs: [setup_for_tests, build_packages, build_cli_archive_macos_x64]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: macos-15-intel
@@ -551,7 +559,7 @@ jobs:
   cli_starter_validation_macos_arm64:
     name: Aspire CLI Starter Validation (macOS ARM64)
     needs: [setup_for_tests, build_packages, build_cli_archive_macos]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: macos-latest
@@ -717,7 +725,7 @@ jobs:
     uses: ./.github/workflows/typescript-api-compat.yml
 
   results:
-    if: ${{ always() && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Final Test Results
     needs: [
diff --git a/.github/workflows/typescript-api-compat.yml b/.github/workflows/typescript-api-compat.yml
index 1d91bd61a72..4317d5f5f07 100644
--- a/.github/workflows/typescript-api-compat.yml
+++ b/.github/workflows/typescript-api-compat.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   typescript_api_compat:
     name: TypeScript API Compatibility
-    if: ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.repository == 'microsoft/aspire' && github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/typescript-sdk-tests.yml b/.github/workflows/typescript-sdk-tests.yml
index 3b15372a95b..b949e516831 100644
--- a/.github/workflows/typescript-sdk-tests.yml
+++ b/.github/workflows/typescript-sdk-tests.yml
@@ -9,6 +9,7 @@ on:
 
 jobs:
   typescript_unit_tests:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: TypeScript SDK Tests Job
     runs-on: ubuntu-latest
     timeout-minutes: 5
diff --git a/.github/workflows/update-actionlint.yml b/.github/workflows/update-actionlint.yml
index 5090e410b70..6c2bf7b4bdf 100644
--- a/.github/workflows/update-actionlint.yml
+++ b/.github/workflows/update-actionlint.yml
@@ -33,7 +33,7 @@ jobs:
   check:
     name: Check for a newer actionlint
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'validate') }}
+    if: ${{ github.repository == 'microsoft/aspire' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'validate') }}
     outputs:
       updated: ${{ steps.check.outputs.updated }}
       previous-version: ${{ steps.check.outputs.previous-version }}
@@ -68,7 +68,7 @@ jobs:
     name: Propose actionlint update
     needs: check
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' && github.ref_name == github.event.repository.default_branch && needs.check.outputs.updated == 'true' && (github.event_name == 'schedule' || inputs.mode == 'propose') }}
+    if: ${{ github.repository == 'microsoft/aspire' && github.ref_name == github.event.repository.default_branch && needs.check.outputs.updated == 'true' && (github.event_name == 'schedule' || inputs.mode == 'propose') }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -119,7 +119,7 @@ jobs:
     name: Create Issue on Failure
     needs: [check, update]
     runs-on: ubuntu-latest
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read   # checkout to require the local .js modules
       issues: write
diff --git a/.github/workflows/update-ai-foundry-models.yml b/.github/workflows/update-ai-foundry-models.yml
index 17c6f8b3618..ab8ff7f0482 100644
--- a/.github/workflows/update-ai-foundry-models.yml
+++ b/.github/workflows/update-ai-foundry-models.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/update-aspire-skills-bundle.yml b/.github/workflows/update-aspire-skills-bundle.yml
index 97b0635a9d4..83988215276 100644
--- a/.github/workflows/update-aspire-skills-bundle.yml
+++ b/.github/workflows/update-aspire-skills-bundle.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   update-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/update-azure-vm-sizes.yml b/.github/workflows/update-azure-vm-sizes.yml
index 96c6516bcec..35fa5dfa2fd 100644
--- a/.github/workflows/update-azure-vm-sizes.yml
+++ b/.github/workflows/update-azure-vm-sizes.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     # 'schedule' only ever runs on the default branch, so the owner guard is the
     # only condition needed here.
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     environment: deployment-testing
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 2543229deca..f1b3c3c900f 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   update-dependencies:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/update-nix-cli-flake.yml b/.github/workflows/update-nix-cli-flake.yml
index a0fa857b7b3..b0a39164c72 100644
--- a/.github/workflows/update-nix-cli-flake.yml
+++ b/.github/workflows/update-nix-cli-flake.yml
@@ -66,6 +66,7 @@ permissions:
 jobs:
   update-nix-flake:
     name: Update Nix flake manifest
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Authorize
diff --git a/.github/workflows/validate-agentic-workflows.yml b/.github/workflows/validate-agentic-workflows.yml
index e61ef09b44b..a45a9780f61 100644
--- a/.github/workflows/validate-agentic-workflows.yml
+++ b/.github/workflows/validate-agentic-workflows.yml
@@ -25,6 +25,7 @@ permissions:
 jobs:
   validate:
     name: Compile, lint, and test agentic workflows
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/validate-copilot-extensions.yml b/.github/workflows/validate-copilot-extensions.yml
index 9c4069d8eb6..83451b330d2 100644
--- a/.github/workflows/validate-copilot-extensions.yml
+++ b/.github/workflows/validate-copilot-extensions.yml
@@ -19,7 +19,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/verify-aspire-skills-bundle.yml b/.github/workflows/verify-aspire-skills-bundle.yml
index f22c87368b8..78a53d5fbe1 100644
--- a/.github/workflows/verify-aspire-skills-bundle.yml
+++ b/.github/workflows/verify-aspire-skills-bundle.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   verify:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
diff --git a/.github/workflows/verify-telemetry-hook-changes.yml b/.github/workflows/verify-telemetry-hook-changes.yml
index 7a5ba7a2024..53b572d3927 100644
--- a/.github/workflows/verify-telemetry-hook-changes.yml
+++ b/.github/workflows/verify-telemetry-hook-changes.yml
@@ -10,6 +10,7 @@ permissions:
 jobs:
   verify:
     name: Telemetry hook update branch
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/warm-cli-e2e-image-cache.yml b/.github/workflows/warm-cli-e2e-image-cache.yml
index f332d07293f..4a36f717639 100644
--- a/.github/workflows/warm-cli-e2e-image-cache.yml
+++ b/.github/workflows/warm-cli-e2e-image-cache.yml
@@ -29,7 +29,7 @@ concurrency:
 jobs:
   warm_cli_e2e_image_cache:
     name: Warm CLI E2E image cache
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
     with:
       includePolyglotImages: true
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index ea4780ea362..7f8dfd51793 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,6 +19,7 @@ permissions: {}
 jobs:
   zizmor:
     name: Zizmor
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/docs/ci/auto-rerun-outerloop-failures.md b/docs/ci/auto-rerun-outerloop-failures.md
index b109e31e55c..09e243cc51b 100644
--- a/docs/ci/auto-rerun-outerloop-failures.md
+++ b/docs/ci/auto-rerun-outerloop-failures.md
@@ -39,7 +39,7 @@ Outerloop Tests run fails
 │  • conclusion == 'failure'            │
 │  • run_attempt <= 3                   │
 │  • event != 'pull_request'            │
-│  • repository_owner == 'microsoft'    │
+│  • repository == 'microsoft/aspire'   │
 └──────────────┬─────────────────────────┘
                │ yes
                ▼
@@ -59,7 +59,7 @@ condition holds:
 | **Attempt limit** | The run must be on attempt ≤ 3. Reruns fire from attempts 1, 2, and 3, so a run gets up to 3 automatic reruns (4 total attempts). |
 | **Failure-only triggering** | Only fires on `workflow_run.conclusion == 'failure'`. A `cancelled` run never triggers a rerun. |
 | **Scheduled/manual only** | Only fires when the outerloop run's trigger was not `pull_request` (`workflow_run.event != 'pull_request'`). PR-triggered outerloop runs (narrow paths filter) are left for the PR author to rerun manually. |
-| **Repository guard** | Only runs on `microsoft/aspire` (`github.repository_owner == 'microsoft'`). |
+| **Repository guard** | Only runs on `microsoft/aspire` (`github.repository == 'microsoft/aspire'`). |
 
 GitHub's `rerun-failed-jobs` API reruns **all** failed jobs for the attempt
 (there is no API to rerun a subset), which is exactly the desired behavior here.
diff --git a/docs/ci/pipeline-failure-issues.md b/docs/ci/pipeline-failure-issues.md
index c58aefd3126..0824e500e0a 100644
--- a/docs/ci/pipeline-failure-issues.md
+++ b/docs/ci/pipeline-failure-issues.md
@@ -37,7 +37,7 @@ re-runs of the same run.
 ## How a run is reported
 
 Each workflow's reporter job runs only on
-`failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft'`
+`failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire'`
 (so PR/manual runs never file issues and forks stay quiet). Because the job is
 gated on `failure()`, it cannot run for a `startup_failure` (no job runs) or a
 `timed_out` run (cancelled-class); the scheduled-workflow scanner **backstops**
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
index 24d7eec3a7a..758ec3e060b 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
@@ -11,19 +11,6 @@ public sealed class BackportWorkflowTests(ITestOutputHelper output)
 {
     private const string WorkflowRelativePath = ".github/workflows/backport.yml";
 
-    [Fact]
-    public void JobsUseExactRepositoryOwnerMembership()
-    {
-        var jobs = Mapping(LoadWorkflow(), "jobs");
-
-        Assert.Equal(
-            "github.event_name == 'schedule' && contains(fromJSON('[\"dotnet\", \"microsoft\"]'), github.repository_owner)",
-            Scalar(Mapping(jobs, "cleanup"), "if"));
-        Assert.Equal(
-            "github.event_name == 'issue_comment' && contains(fromJSON('[\"dotnet\", \"microsoft\"]'), github.repository_owner) && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/backport to')",
-            Scalar(Mapping(jobs, "backport"), "if"));
-    }
-
     [Fact]
     [RequiresTools(["node"])]
     public async Task CleanupCollectsWorkflowRunIdsBeforeDeleting()
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
index 44fb208b600..208d76bdf81 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
@@ -9,15 +9,6 @@ namespace Infrastructure.Tests;
 
 public sealed class DeploymentTestCommandTests(ITestOutputHelper output)
 {
-    [Fact]
-    public void CommandPrefilterSelectsCandidatesOnMicrosoftPullRequests()
-    {
-        var condition = Scalar(LoadJob(), "if");
-        Assert.Equal(
-            "${{ startsWith(github.event.comment.body, '/deployment-test') && github.event.issue.pull_request && github.repository_owner == 'microsoft' }}",
-            string.Join(" ", condition.Split((char[]?)null, StringSplitOptions.RemoveEmptyEntries)));
-    }
-
     [Fact]
     public void DeploymentStepsRequireRepositoryWriteAccess()
     {
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
index 9eb0457e02c..c06249d2592 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
@@ -251,52 +251,6 @@ public void GenericReviewChecksOnlyStableNonExperimentalAtsBreaks()
         Assert.False(skill.Contains("breaking changes to public API without justification", StringComparison.Ordinal));
     }
 
-    [Fact]
-    public void CiRunsSelectorDrivenTestsForEveryRequiredPr()
-    {
-        var normalTests = Mapping(s_ciJobs, "tests");
-        Assert.Equal("./.github/workflows/tests.yml", Scalar(normalTests, "uses"));
-        Assert.Equal(
-            "${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}",
-            Scalar(normalTests, "if"));
-    }
-
-    [Fact]
-    public void StabilizationJobUsesOneEnableSwitchAndRunsOnlyOnPrs()
-    {
-        var outputs = Mapping(Mapping(s_ciJobs, "prepare_for_ci"), "outputs");
-        Assert.Contains(Scalar(outputs, "STABILIZATION_ENABLED"), new[] { "true", "false" });
-
-        var job = Mapping(s_ciJobs, "stabilization_check");
-        Assert.Equal(
-            "${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' && " +
-            "github.event_name == 'pull_request' && needs.prepare_for_ci.outputs.STABILIZATION_ENABLED == 'true' }}",
-            Scalar(job, "if"));
-        Assert.False(job.Children.ContainsKey(new YamlScalarNode("env")));
-
-        var steps = Steps(job);
-        Assert.Equal(
-            [
-                "Checkout code",
-                "Build + pack with StabilizePackageVersion=true",
-                "Run version-sensitive Aspire.Cli.Tests classes under stabilization",
-                "aspire init + restore smoke against stable local feed",
-                "Upload logs",
-            ],
-            steps.Select(step => Scalar(step, "name")));
-        Assert.All(steps, step =>
-        {
-            if (Scalar(step, "name") == "Upload logs")
-            {
-                Assert.Equal("${{ always() }}", Scalar(step, "if"));
-            }
-            else
-            {
-                Assert.False(step.Children.ContainsKey(new YamlScalarNode("if")));
-            }
-        });
-    }
-
     [Fact]
     public void FinalResultsRequireStabilizationOnlyWhenEnabledForPrs()
     {
@@ -316,25 +270,6 @@ public void FinalResultsRequireStabilizationOnlyWhenEnabledForPrs()
             CollapseWhitespace(Scalar(failureStep, "if")));
     }
 
-    [Fact]
-    public void CiFailureTrackerDoesNotRequirePrOnlyStabilizationOnPush()
-    {
-        var tracker = Mapping(s_ciJobs, "ci_failure_tracker");
-
-        Assert.Equal(["actionlint", "prepare_for_ci", "tests", "stabilization_check"], SequenceScalars(tracker, "needs"));
-        Assert.Equal(
-            "${{ always() && github.event_name == 'push' && github.repository_owner == 'microsoft' }}",
-            Scalar(tracker, "if"));
-
-        var scriptStep = Assert.Single(Steps(tracker), step => Scalar(step, "name") == "File or close the red-main issue");
-        var environment = Mapping(scriptStep, "env");
-        Assert.Equal("${{ contains(needs.*.result, 'failure') }}", Scalar(environment, "CI_RED"));
-        Assert.Equal(
-            "${{ needs.actionlint.result == 'success' && needs.prepare_for_ci.result == 'success' && " +
-            "needs.tests.result == 'success' }}",
-            CollapseWhitespace(Scalar(environment, "CI_GREEN")));
-    }
-
     private static List<YamlMappingNode> Steps(YamlMappingNode job)
         => ((YamlSequenceNode)job.Children[new YamlScalarNode("steps")]).Cast<YamlMappingNode>().ToList();