diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 219295a..eb3636b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,27 +1,46 @@
-name: ci
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    # Publish only from master, even for manual workflow_dispatch runs, so a
-    # dispatch from a feature branch can't overwrite the :latest image.
-    if: github.ref == 'refs/heads/master'
-    steps:
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v2
-        with:
-          push: true
-          tags: braunbearded/python-dvr:latest,braunbearded/python-dvr:${{ github.sha }}
+name: ci
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    # Publish only from master, even for manual workflow_dispatch runs, so a
+    # dispatch from a feature branch can't overwrite the :latest image.
+    if: github.ref == 'refs/heads/master'
+    steps:
+      # Without DockerHub credentials the publish can't run; skip it (and keep
+      # the job green) instead of failing every push to master. The secrets are
+      # scoped to this step only (the login action takes them via its inputs).
+      - name: Check DockerHub credentials
+        id: creds
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::DOCKERHUB_USERNAME/DOCKERHUB_TOKEN are not set; skipping the image publish."
+          fi
+      - name: Set up QEMU
+        if: steps.creds.outputs.present == 'true'
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        if: steps.creds.outputs.present == 'true'
+        uses: docker/setup-buildx-action@v1
+      - name: Login to DockerHub
+        if: steps.creds.outputs.present == 'true'
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push
+        if: steps.creds.outputs.present == 'true'
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: braunbearded/python-dvr:latest,braunbearded/python-dvr:${{ github.sha }}
diff --git a/CLAUDE.md b/CLAUDE.md
index c72a11e..df6c2ec 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -47,8 +47,11 @@ own `requirements.txt` and is self-contained.
 ### Docker / CI
 
 `Dockerfile` runs `download-local-files.py`. `.github/workflows/main.yml`
-builds and pushes that image to Docker Hub on every branch push;
-`codeql.yml` runs CodeQL Python analysis on master.
+builds and pushes that image to Docker Hub on pushes to `master` (only
+when the `DOCKERHUB_USERNAME`/`DOCKERHUB_TOKEN` secrets are set — it skips
+the publish otherwise); `codeql.yml` runs CodeQL Python analysis on
+master. `.github/workflows/test.yml` lint/smoke-tests the library on
+pushes and PRs.
 
 ## Architecture