diff --git a/.github/workflows/load-configuration.yml b/.github/workflows/load-configuration.yml
index 67ef6464..0b2b4083 100644
--- a/.github/workflows/load-configuration.yml
+++ b/.github/workflows/load-configuration.yml
@@ -50,17 +50,37 @@ jobs:
     steps:
       - name: Set KurrentDB Runtime Configuration Properties
         id: set
+        env:
+          RUNTIME: ${{ inputs.runtime }}
+          REGISTRY: ${{ inputs.registry }}
+          IMAGE: ${{ inputs.image }}
+          TAG: ${{ inputs.tag }}
+          IMAGES: ${{ vars.KURRENTDB_DOCKER_IMAGES }}
+          SECRETS_AVAILABLE: ${{ secrets.CLOUDSMITH_CICD_USER != '' }}
         run: |
-          case ${{ inputs.runtime }} in
-            "qa")
-              echo "registry=${{ inputs.registry }}" >> $GITHUB_OUTPUT
-              echo "image=${{ inputs.image }}" >> $GITHUB_OUTPUT
-              echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
-            ;;
+          if [ "$RUNTIME" = "qa" ]; then
+            {
+              echo "registry=$REGISTRY"
+              echo "image=$IMAGE"
+              echo "tag=$TAG"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
 
-            *)
-              echo "registry=${{ fromJSON(vars.KURRENTDB_DOCKER_IMAGES)[inputs.runtime].registry }}" >> $GITHUB_OUTPUT
-              echo "image=${{ fromJSON(vars.KURRENTDB_DOCKER_IMAGES)[inputs.runtime].image }}" >> $GITHUB_OUTPUT
-              echo "tag=${{ fromJSON(vars.KURRENTDB_DOCKER_IMAGES)[inputs.runtime].tag }}" >> $GITHUB_OUTPUT
-            ;;
-          esac
+          # Runs without registry credentials must use the anonymously pullable
+          # lts image: forks get neither vars nor secrets, dependabot gets vars
+          # but not secrets, so key the fallback on secrets, not on vars.
+          if [ "$SECRETS_AVAILABLE" != "true" ] || [ -z "$IMAGES" ]; then
+            IMAGES='{"lts":{"registry":"docker.io/kurrentplatform","image":"kurrentdb","tag":"lts"}}'
+          fi
+
+          CONFIG=$(jq -ce --arg runtime "$RUNTIME" '.[$runtime]' <<< "$IMAGES") || {
+            echo "No image configuration for runtime '$RUNTIME'" >&2
+            exit 1
+          }
+
+          {
+            echo "registry=$(jq -r '.registry' <<< "$CONFIG")"
+            echo "image=$(jq -r '.image' <<< "$CONFIG")"
+            echo "tag=$(jq -r '.tag' <<< "$CONFIG")"
+          } >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d7b9116a..1f8277c7 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,7 +5,7 @@ on:
       - "**.md"
   push:
     branches:
-      - main
+      - master
   schedule:
     - cron: "0 3 * * 0" # Every sunday at 3am UTC.
 
@@ -45,7 +45,7 @@ jobs:
     name: Code quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Corepack
         run: corepack enable
@@ -64,65 +64,34 @@ jobs:
           git update-index --refresh
           git diff-index --exit-code --name-status HEAD --
 
+  select_runtimes:
+    name: Select runtimes
+    runs-on: ubuntu-latest
+    outputs:
+      runtimes: ${{ steps.set.outputs.runtimes }}
+    env:
+      # Secrets are not passed to runs from forks or dependabot. Without them,
+      # only the anonymously pullable lts image can be tested.
+      SECRETS_AVAILABLE: ${{ secrets.CLOUDSMITH_CICD_USER != '' }}
+    steps:
+      - id: set
+        run: |
+          if [ "$SECRETS_AVAILABLE" = "true" ]; then
+            echo 'runtimes=["previous-lts", "lts", "ci"]' >> "$GITHUB_OUTPUT"
+          else
+            echo 'runtimes=["lts"]' >> "$GITHUB_OUTPUT"
+          fi
+
   tests:
-    needs: validation
+    needs: [validation, select_runtimes]
 
     strategy:
       fail-fast: false
       matrix:
-        runtime: [previous-lts, lts, ci]
+        runtime: ${{ fromJSON(needs.select_runtimes.outputs.runtimes) }}
 
     name: Tests
     uses: ./.github/workflows/tests.yml
     with:
       runtime: ${{ matrix.runtime }}
     secrets: inherit
-
-  plugins:
-    needs: tests
-    if: false
-    name: "${{ matrix.group.name }}"
-    strategy:
-      fail-fast: false
-      matrix:
-        group:
-          - name: plugins
-            path: ./src/plugins
-    env:
-      # GitHub only passes secrets to the main repo, so we need to skip some things if they are unavailable
-      SECRETS_AVAILABLE: ${{ secrets.EVENTSTORE_CLOUD_ID != null }}
-      KURRENT_VERSION: "24.2.0-jammy"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: .github/files/.nvmrc
-
-      - name: NodeJS version
-        run: node -v
-
-      - name: Corepack
-        run: corepack enable
-
-      - name: Login to Cloudsmith
-        uses: docker/login-action@v3
-        with:
-          registry: docker.eventstore.com
-          username: ${{ secrets.CLOUDSMITH_CICD_USER }}
-          password: ${{ secrets.CLOUDSMITH_CICD_TOKEN }}
-
-      - name: Install
-        run: yarn
-
-      - name: Corepack
-        run: corepack enable
-
-      - name: Build
-        run: yarn build
-
-      - name: Run Tests
-        run: yarn test ${{ matrix.group.path }} --ci --run-in-band --forceExit
-        env:
-          KURRENT_IMAGE: "docker.eventstore.com/eventstore-ee/eventstoredb-commercial:${{ env.KURRENT_VERSION }}"
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index 948573b1..83271c52 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -26,3 +26,4 @@ jobs:
       registry: ${{ inputs.registry }}
       image: ${{ inputs.image }}
       tag: ${{ inputs.tag }}
+    secrets: inherit
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 962d0305..eb557c00 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,6 +30,7 @@ jobs:
       registry: ${{ inputs.registry }}
       image: ${{ inputs.image }}
       tag: ${{ inputs.tag }}
+    secrets: inherit
 
   test:
     needs: load_configuration
@@ -61,10 +62,13 @@ jobs:
             path: ./src/opentelemetry
 
     runs-on: ubuntu-latest
+    env:
+      SECRETS_AVAILABLE: ${{ secrets.CLOUDSMITH_CICD_USER != '' }}
     steps:
       - uses: actions/checkout@v4
 
       - name: Login to Cloudsmith
+        if: env.SECRETS_AVAILABLE == 'true'
         uses: docker/login-action@v3
         with:
           registry: ${{ needs.load_configuration.outputs.registry }}