diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e6127e5..df1b133 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,7 +2,6 @@ name: build
 
 on:
   push:
-    branches: [main]
   pull_request:
 
 permissions:
@@ -33,7 +32,7 @@ jobs:
     # Only pushes to main publish, so pull request runs never receive a token
     # with packages: write — a branch PR can change this workflow and its code
     # runs with whatever permissions the run was granted.
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: test
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index d3a2ce3..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: "codeql"
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: '0 6 * * 1' # every Monday 06:00 UTC
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['go']
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v7
-        with:
-          go-version: stable
-
-      - uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-
-      - uses: github/codeql-action/analyze@v3