diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3686e24..2a86872 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,7 +91,20 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # Push to Docker Hub only when credentials are configured; forks and
+      # repos without DOCKERHUB_* secrets still get a build-only smoke test.
+      - name: Check Docker Hub credentials
+        id: creds
+        run: |
+          if [ -n "${{ secrets.DOCKERHUB_USERNAME }}" ] && [ -n "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "DOCKERHUB_USERNAME/DOCKERHUB_TOKEN not set; building without push" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Login to Docker Hub
+        if: steps.creds.outputs.available == 'true'
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -105,8 +118,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          push: true
-          platforms: linux/amd64,linux/arm64
+          push: ${{ steps.creds.outputs.available == 'true' }}
+          platforms: ${{ steps.creds.outputs.available == 'true' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
           build-args: VERSION=${{ steps.version.outputs.sha_short }}
           tags: |
             impingo/liveforge:latest