diff --git a/.github/workflows/build-arik-container.yml b/.github/workflows/build-arik-container.yml
index 9c3a8a33c..62588b36f 100644
--- a/.github/workflows/build-arik-container.yml
+++ b/.github/workflows/build-arik-container.yml
@@ -44,6 +44,10 @@ jobs:
 
   build:
     needs: test
+    # Only the arik branch publishes :latest — production pulls that tag through
+    # Watchtower. A dispatch on any other branch runs the test job alone, which
+    # is how a work branch gets type-checked without shipping itself.
+    if: github.ref == 'refs/heads/arik'
     runs-on: ubuntu-latest
     permissions:
       contents: read