diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f4b5e3d..1b846f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,16 @@ jobs:
       - name: Set up Docker buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
+      # Fork PRs run with a read-only GITHUB_TOKEN (no packages:write), so
+      # they cannot push a ci-<sha> image — and with no image, every Linux
+      # leg used to skip, leaving fork PRs with no Linux CI at all. Fork
+      # PRs instead run inside the rolling `ci-main` image that every main
+      # push publishes below: same toolchain, just not rebuilt from the
+      # PR's Dockerfile. (The rare fork PR that EDITS
+      # .devcontainer/Dockerfile still tests with the base image — push
+      # its branch to origin to exercise the Dockerfile change.)
       - name: Log in to GitHub Container Registry
+        if: github.event.pull_request.head.repo.fork != true
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
@@ -37,22 +46,37 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # GHCR requires a lowercase owner; compute the ref once and hand it to
-      # the downstream jobs through a job output.
+      # the downstream jobs through a job output. `image` is what the Linux
+      # legs run in; `tags` is what this job pushes (empty on fork PRs —
+      # nothing is pushed; main pushes also advance the rolling ci-main tag).
       - name: Compute image ref
         id: ref
         env:
           OWNER: ${{ github.repository_owner }}
+          IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }}
+          EVENT: ${{ github.event_name }}
         run: |
-          echo "image=ghcr.io/${OWNER,,}/eigenscript-dev:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          BASE="ghcr.io/${OWNER,,}/eigenscript-dev"
+          if [ "$IS_FORK" = "true" ]; then
+            echo "image=$BASE:ci-main" >> "$GITHUB_OUTPUT"
+            echo "tags=" >> "$GITHUB_OUTPUT"
+          elif [ "$EVENT" = "push" ]; then
+            echo "image=$BASE:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            echo "tags=$BASE:ci-${{ github.sha }},$BASE:ci-main" >> "$GITHUB_OUTPUT"
+          else
+            echo "image=$BASE:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            echo "tags=$BASE:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Build and push dev image
+        if: github.event.pull_request.head.repo.fork != true
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: .devcontainer/Dockerfile
           platforms: linux/amd64
           push: true
-          tags: ${{ steps.ref.outputs.image }}
+          tags: ${{ steps.ref.outputs.tags }}
           cache-from: type=gha
           cache-to: type=gha,mode=max