diff --git a/.github/workflows/build-master.yml b/.github/workflows/build-master.yml
index 6623ac1bf0..83f6e67c04 100644
--- a/.github/workflows/build-master.yml
+++ b/.github/workflows/build-master.yml
@@ -7,10 +7,9 @@ jobs:
   build-static-page:
     name: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     env:
       DOCKER_BUILDKIT: '1'
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
     steps:
       - name: print docker info
         run: docker version && docker info
@@ -19,5 +18,13 @@ jobs:
         run: docker build --build-arg=ENABLE_ARCHIVES=true --target=deploy-source --output=./_site .
       - name: upload files to S3 bucket
         run: aws s3 sync --acl public-read _site s3://docs.docker.com-test-us-east-1/ --delete
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        if: github.repository == 'docker/docker.github.io' && github.event_name == 'push'
       - name: invalidate docs website cache
         run: aws --region us-east-1 lambda invoke --function-name arn:aws:lambda:us-east-1:710015040892:function:docs-test-cache-invalidator response.json
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        if: github.repository == 'docker/docker.github.io' && github.event_name == 'push'