diff --git a/.github/workflows/sansec-ecomscan.yml b/.github/workflows/sansec-ecomscan.yml
index 440323e..11476bc 100644
--- a/.github/workflows/sansec-ecomscan.yml
+++ b/.github/workflows/sansec-ecomscan.yml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   run-ecomscan:
+    # Skip if it's a push event on a PR (it can't access secrets)
+    if: github.event.pull_request == null || github.event_name != 'push'
     name: Run Sansec eComscan
     runs-on: ubuntu-latest
     permissions: