diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index bba30d27be..3f34a3fe32 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -243,6 +243,7 @@ jobs:
           exit 1
 
   amis:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     needs:
       - builds-aarch64-linux
       - builds-x86_64-linux
@@ -275,10 +276,15 @@ jobs:
       - schema
     steps:
       - name: Check dependent job results
-        if: contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped')
+        env:
+          ALLOW_SKIPPED_AMIS: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
         run: |
-          jq -rn --argjson needs '${{ toJSON(needs) }}' '$needs|to_entries[]|select(.value.result!="success")|"::error::"+.key+": "+.value.result'
-          exit 1
+          errors=$(jq -rn --argjson needs '${{ toJSON(needs) }}' --arg allow_skipped_amis "$ALLOW_SKIPPED_AMIS" \
+            '$needs|to_entries[]|select(.value.result!="success" and (.key!="amis" or .value.result!="skipped" or $allow_skipped_amis!="true"))|"::error::"+.key+": "+.value.result')
+          if [ -n "$errors" ]; then
+            echo "$errors"
+            exit 1
+          fi
 
   version-diff:
     name: Package version diff
@@ -338,7 +344,7 @@ jobs:
 
   version-diff-comment:
     name: Post package version diff comment
-    if: always() && github.event_name == 'pull_request'
+    if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     needs: version-diff
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml
index d6682a0393..6507741c87 100644
--- a/.github/workflows/nix-dependency-analysis.yml
+++ b/.github/workflows/nix-dependency-analysis.yml
@@ -27,6 +27,7 @@ concurrency:
 jobs:
   dependency-analysis:
     name: Package Dependency Analysis
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-4vcpu-ubuntu-2404-arm
     steps:
       - name: Checkout repository
@@ -79,6 +80,7 @@ jobs:
 
   extension-analysis:
     name: Extension Dependency Analysis
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
diff --git a/nix/tests/expected/pgbouncer.out b/nix/tests/expected/pgbouncer.out
index 196e8cd5d9..3385e69363 100644
--- a/nix/tests/expected/pgbouncer.out
+++ b/nix/tests/expected/pgbouncer.out
@@ -70,10 +70,12 @@ create role test_expired_user_password with login password 'expired_password' va
 create role test_valid_user_password with login password 'valid_password' valid until '2100-01-01 00:00:00+00';
 -- Update the pg_authid catalog directly to replace with a known SCRAM hash
 update pg_authid set rolpassword = 'SCRAM-SHA-256$4096:testsaltbase64$storedkeybase64$serverkeybase64' where rolname = 'test_valid_user_password';
-select pgbouncer.get_auth('test_expired_user_password');
-           get_auth            
--------------------------------
- (test_expired_user_password,)
+-- Expand the result so psql can display a null password explicitly.
+\pset null '<null>'
+select * from pgbouncer.get_auth('test_expired_user_password');
+          username          | password 
+----------------------------+----------
+ test_expired_user_password | <null>
 (1 row)
 
 select pgbouncer.get_auth('test_valid_user_password');
diff --git a/nix/tests/sql/pgbouncer.sql b/nix/tests/sql/pgbouncer.sql
index e9beb3e78b..65580fb9cf 100644
--- a/nix/tests/sql/pgbouncer.sql
+++ b/nix/tests/sql/pgbouncer.sql
@@ -58,7 +58,9 @@ create role test_valid_user_password with login password 'valid_password' valid
 -- Update the pg_authid catalog directly to replace with a known SCRAM hash
 update pg_authid set rolpassword = 'SCRAM-SHA-256$4096:testsaltbase64$storedkeybase64$serverkeybase64' where rolname = 'test_valid_user_password';
 
-select pgbouncer.get_auth('test_expired_user_password');
+-- Expand the result so psql can display a null password explicitly.
+\pset null '<null>'
+select * from pgbouncer.get_auth('test_expired_user_password');
 
 select pgbouncer.get_auth('test_valid_user_password');