diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87b1f81..977745b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,20 +34,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      # pinbench_pdl and pinbench_cdl are private, and so needed twice: as
-      # submodules, and as git dependencies that `flutter pub get` fetches. The
-      # default token reads neither. Each has a read-only deploy key, whose
-      # private half is a secret here; the key's comment names its repository,
-      # which is how the action rewrites that repository's https:// and git@
-      # URLs to use it — for git and therefore for pub. Drop this once the two
-      # repositories are public.
-      - name: Load the deploy keys for the private format repositories
-        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        with:
-          ssh-private-key: |
-            ${{ secrets.PDL_DEPLOY_KEY }}
-            ${{ secrets.CDL_DEPLOY_KEY }}
-
       - name: Fetch submodules
         run: git submodule update --init --recursive
 
@@ -216,20 +202,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      # pinbench_pdl and pinbench_cdl are private, and so needed twice: as
-      # submodules, and as git dependencies that `flutter pub get` fetches. The
-      # default token reads neither. Each has a read-only deploy key, whose
-      # private half is a secret here; the key's comment names its repository,
-      # which is how the action rewrites that repository's https:// and git@
-      # URLs to use it — for git and therefore for pub. Drop this once the two
-      # repositories are public.
-      - name: Load the deploy keys for the private format repositories
-        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        with:
-          ssh-private-key: |
-            ${{ secrets.PDL_DEPLOY_KEY }}
-            ${{ secrets.CDL_DEPLOY_KEY }}
-
       - name: Fetch submodules
         run: git submodule update --init --recursive
 
@@ -337,20 +309,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      # pinbench_pdl and pinbench_cdl are private, and so needed twice: as
-      # submodules, and as git dependencies that `flutter pub get` fetches. The
-      # default token reads neither. Each has a read-only deploy key, whose
-      # private half is a secret here; the key's comment names its repository,
-      # which is how the action rewrites that repository's https:// and git@
-      # URLs to use it — for git and therefore for pub. Drop this once the two
-      # repositories are public.
-      - name: Load the deploy keys for the private format repositories
-        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        with:
-          ssh-private-key: |
-            ${{ secrets.PDL_DEPLOY_KEY }}
-            ${{ secrets.CDL_DEPLOY_KEY }}
-
       - name: Fetch submodules
         run: git submodule update --init --recursive
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ab3759..52d89c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,8 +35,11 @@ permissions:
   contents: read
 
 jobs:
+  # A trial needs the signing keys, which a pull request from a fork or
+  # Dependabot does not get, and a macOS build is the dearest minute there is.
   version:
     name: Version
+    if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
     runs-on: ubuntu-latest
     outputs:
       name: ${{ steps.v.outputs.name }}
@@ -81,15 +84,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      # The two format packages are private: submodules here, and git
-      # dependencies for pub. See ci.yml.
-      - name: Load the deploy keys for the private format repositories
-        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        with:
-          ssh-private-key: |
-            ${{ secrets.PDL_DEPLOY_KEY }}
-            ${{ secrets.CDL_DEPLOY_KEY }}
-
       - name: Fetch submodules
         run: git submodule update --init --recursive
 
@@ -222,14 +216,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      # tools/release_metadata.dart needs the app's dependencies (crypto),
-      # which resolve through the private format packages.
-      - name: Load the deploy keys for the private format repositories
-        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        with:
-          ssh-private-key: |
-            ${{ secrets.PDL_DEPLOY_KEY }}
-            ${{ secrets.CDL_DEPLOY_KEY }}
       - run: git submodule update --init --recursive
       - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with: