diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7196554..219295a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,11 +2,14 @@ name: ci
 on:
   push:
     branches:
-      - "*"
+      - master
   workflow_dispatch:
 jobs:
   docker:
     runs-on: ubuntu-latest
+    # Publish only from master, even for manual workflow_dispatch runs, so a
+    # dispatch from a feature branch can't overwrite the :latest image.
+    if: github.ref == 'refs/heads/master'
     steps:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1