diff --git a/.github/workflows/alcf.yml b/.github/workflows/alcf.yml
index cc55d8ca..e87b8162 100644
--- a/.github/workflows/alcf.yml
+++ b/.github/workflows/alcf.yml
@@ -18,11 +18,14 @@ name: ALCF CI
 # token, i.e. a bot user, and ALCF's Jacamar runners refuse bot-attributed pipelines
 # ("bot account token used for job, unsupported by runner"). Trigger-token pipelines
 # run as the user who created the token, which Jacamar accepts.
+#
+# Automatic runs are disabled while the Aurora pipelines are broken (every pipeline since
+# 2026-10-10 fails with ZE_RESULT_ERROR_MODULE_BUILD_FAILURE, on main too). Until then the
+# 'alcf-ci' label is the only way in, for same-repo PRs as well. To re-enable, restore the
+# push (main) and pull_request triggers and the fork-only condition on the label below,
+# and "push" in the workflow rules of .gitlab-ci.yml.
 
 on:
-  push:
-    branches: [main]
-  pull_request:
   pull_request_target:
     types: [labeled]
 
@@ -39,13 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     # PBS queue wait + 1 h walltime + build stage; generous but below the 6 h runner cap
     timeout-minutes: 330
-    if: >-
-      github.event_name == 'push' ||
-      (github.event_name == 'pull_request' &&
-       github.event.pull_request.head.repo.full_name == github.repository) ||
-      (github.event_name == 'pull_request_target' &&
-       github.event.label.name == 'alcf-ci' &&
-       github.event.pull_request.head.repo.full_name != github.repository)
+    if: github.event.label.name == 'alcf-ci'
     env:
       GITLAB_HOST: gitlab-ci.alcf.anl.gov
       GITLAB_PROJECT: mschanen/oneAPI-jl
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index cf54dd92..3c71f72a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -22,7 +22,9 @@ workflow:
     # "trigger" covers fork-PR pipelines, created via a pipeline trigger token by
     # .github/workflows/alcf.yml so they run as a real user instead of the mirror
     # project's bot (which the Jacamar runners refuse).
-    - if: $CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api" || $CI_PIPELINE_SOURCE == "trigger"
+    # "push" (i.e. every mirror sync) is left out while automatic runs are disabled; see
+    # .github/workflows/alcf.yml.
+    - if: $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api" || $CI_PIPELINE_SOURCE == "trigger"
 
 default:
   interruptible: true  # force-pushes cancel stale runs instead of queueing behind them