diff --git a/.github/workflows/node.yaml b/.github/workflows/node.yaml
index 76a8ffb363..6e4a4c8a36 100644
--- a/.github/workflows/node.yaml
+++ b/.github/workflows/node.yaml
@@ -177,25 +177,33 @@ jobs:
           # debug output
           echo "dockerhub-publish $DOCKERHUB_PUBLISH"
           echo "dockerhub-publish=$DOCKERHUB_PUBLISH" >> $GITHUB_OUTPUT
-      - name: Check if push to GHCR is enabled
-        id: check-ghcr
-        env:
-          GHCR_ENABLED: ${{ secrets.GHCR_ENABLED }}
+      - name: Determine if images should be published to GHCR
+        id: ghcr
         run: |
-          echo "Enable push to GHCR: ${{ env.GHCR_ENABLED != '' }}"
-          echo "enable=${{ env.GHCR_ENABLED != '' }}" >> $GITHUB_OUTPUT
-      - name: Check if there is access to repo secrets (needed for build and push)
-        if: steps.dockerhub.outputs.dockerhub-publish == '1' || steps.check-ghcr.outputs.enable == 'true'
-        id: check-build-and-push
+          # push to GHCR on main, release branches, and tags for the official repo
+          if [[ "${{ github.repository_owner }}" != "Sofie-Automation" || "${{ github.event_name }}" != "push" ]]
+          then
+            GHCR_PUBLISH="0"
+          elif [[ "${{ github.ref }}" =~ ^refs/heads/release([0-9]+)$ || "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == refs/tags/* ]]
+          then
+            GHCR_PUBLISH="1"
+          else
+            GHCR_PUBLISH="0"
+          fi
+          echo "ghcr-publish $GHCR_PUBLISH"
+          echo "ghcr-publish=$GHCR_PUBLISH" >> $GITHUB_OUTPUT
+      - name: Check if there is access to repo secrets (needed for DockerHub push)
+        if: steps.dockerhub.outputs.dockerhub-publish == '1'
+        id: check-dockerhub-secrets
         env:
           SECRET_ACCESS: ${{ secrets.DOCKERHUB_IMAGE_PREFIX }}
         run: |
-          echo "Enable build and push: ${{ env.SECRET_ACCESS != '' }}"
+          echo "Enable DockerHub push: ${{ env.SECRET_ACCESS != '' }}"
           echo "enable=${{ env.SECRET_ACCESS != '' }}" >> $GITHUB_OUTPUT
 
       # No-push build if no destination
       - name: Build without push
-        if: steps.check-build-and-push.outputs.enable != 'true'
+        if: steps.ghcr.outputs.ghcr-publish != '1' && (steps.dockerhub.outputs.dockerhub-publish != '1' || steps.check-dockerhub-secrets.outputs.enable != 'true')
         uses: docker/build-push-action@v7
         with:
           context: .
@@ -206,7 +214,7 @@ jobs:
       # GHCR build
       - name: Get the Docker tag for GHCR
         id: ghcr-tag
-        if: steps.check-build-and-push.outputs.enable == 'true'
+        if: steps.ghcr.outputs.ghcr-publish == '1'
         uses: docker/metadata-action@v6
         with:
           images: |
@@ -217,14 +225,14 @@ jobs:
             type=ref,event=tag
             type=raw,value=latest,enable={{is_default_branch}}
       - name: Login to GitHub Container Registry
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true'
+        if: steps.ghcr.outputs.ghcr-publish == '1' && steps.ghcr-tag.outputs.tags != ''
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push to GHCR
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
+        if: steps.ghcr.outputs.ghcr-publish == '1' && steps.ghcr-tag.outputs.tags != ''
         uses: docker/build-push-action@v7
         with:
           context: .
@@ -238,7 +246,7 @@ jobs:
       # Dockerhub push
       - name: Get the Docker tag for DockerHub
         id: dockerhub-tag
-        if: steps.check-build-and-push.outputs.enable == 'true'
+        if: steps.check-dockerhub-secrets.outputs.enable == 'true'
         uses: docker/metadata-action@v6
         with:
           images: |
@@ -249,13 +257,13 @@ jobs:
             type=ref,event=tag
             type=raw,value=latest,enable={{is_default_branch}}
       - name: Login to DockerHub
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
+        if: steps.check-dockerhub-secrets.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and push to DockerHub
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
+        if: steps.check-dockerhub-secrets.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
         uses: docker/build-push-action@v7
         with:
           context: .
@@ -312,7 +320,7 @@ jobs:
         id: dockerhub
         run: |
           # check if a release branch, or main, or a tag
-          if [[ "${{ github.ref }}" =~ ^refs/heads/release([0-9]+)$ || "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/tags/*" ]]
+          if [[ "${{ github.ref }}" =~ ^refs/heads/release([0-9]+)$ || "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == refs/tags/* ]]
           then
             DOCKERHUB_PUBLISH="1"
           else
@@ -321,25 +329,33 @@ jobs:
           # debug output
           echo "dockerhub-publish $DOCKERHUB_PUBLISH"
           echo "dockerhub-publish=$DOCKERHUB_PUBLISH" >> $GITHUB_OUTPUT
-      - name: Check if push to GHCR is enabled
-        id: check-ghcr
-        env:
-          GHCR_ENABLED: ${{ secrets.GHCR_ENABLED }}
+      - name: Determine if images should be published to GHCR
+        id: ghcr
         run: |
-          echo "Enable push to GHCR: ${{ env.GHCR_ENABLED != '' }}"
-          echo "enable=${{ env.GHCR_ENABLED != '' }}" >> $GITHUB_OUTPUT
-      - name: Check if there is access to repo secrets (needed for build and push)
-        if: steps.dockerhub.outputs.dockerhub-publish == '1' || steps.check-ghcr.outputs.enable == 'true'
-        id: check-build-and-push
+          # push to GHCR on main, release branches, and tags for the official repo
+          if [[ "${{ github.repository_owner }}" != "Sofie-Automation" || "${{ github.event_name }}" != "push" ]]
+          then
+            GHCR_PUBLISH="0"
+          elif [[ "${{ github.ref }}" =~ ^refs/heads/release([0-9]+)$ || "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == refs/tags/* ]]
+          then
+            GHCR_PUBLISH="1"
+          else
+            GHCR_PUBLISH="0"
+          fi
+          echo "ghcr-publish $GHCR_PUBLISH"
+          echo "ghcr-publish=$GHCR_PUBLISH" >> $GITHUB_OUTPUT
+      - name: Check if there is access to repo secrets (needed for DockerHub push)
+        if: steps.dockerhub.outputs.dockerhub-publish == '1'
+        id: check-dockerhub-secrets
         env:
           SECRET_ACCESS: ${{ secrets.DOCKERHUB_IMAGE_PREFIX }}
         run: |
-          echo "Enable build and push: ${{ env.SECRET_ACCESS != '' }}"
+          echo "Enable DockerHub push: ${{ env.SECRET_ACCESS != '' }}"
           echo "enable=${{ env.SECRET_ACCESS != '' }}" >> $GITHUB_OUTPUT
 
       # No-push build if no destination
       - name: Build without push
-        if: steps.check-build-and-push.outputs.enable != 'true'
+        if: steps.ghcr.outputs.ghcr-publish != '1' && (steps.dockerhub.outputs.dockerhub-publish != '1' || steps.check-dockerhub-secrets.outputs.enable != 'true')
         uses: docker/build-push-action@v7
         with:
           context: ./packages
@@ -350,7 +366,7 @@ jobs:
       # GHCR build
       - name: Get the Docker tag for GHCR
         id: ghcr-tag
-        if: steps.check-build-and-push.outputs.enable == 'true'
+        if: steps.ghcr.outputs.ghcr-publish == '1'
         uses: docker/metadata-action@v6
         with:
           images: |
@@ -361,14 +377,14 @@ jobs:
             type=ref,event=tag
             type=raw,value=latest,enable={{is_default_branch}}
       - name: Login to GitHub Container Registry
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true'
+        if: steps.ghcr.outputs.ghcr-publish == '1' && steps.ghcr-tag.outputs.tags != ''
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push to GHCR
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
+        if: steps.ghcr.outputs.ghcr-publish == '1' && steps.ghcr-tag.outputs.tags != ''
         uses: docker/build-push-action@v7
         with:
           context: ./packages
@@ -377,11 +393,12 @@ jobs:
           provenance: false
           labels: ${{ steps.ghcr-tag.outputs.labels }}
           tags: "${{ steps.ghcr-tag.outputs.tags }}"
+          github-token: ${{ github.token }}
 
       # Dockerhub push
       - name: Get the Docker tag for DockerHub
         id: dockerhub-tag
-        if: steps.check-build-and-push.outputs.enable == 'true'
+        if: steps.check-dockerhub-secrets.outputs.enable == 'true'
         uses: docker/metadata-action@v6
         with:
           images: |
@@ -392,13 +409,13 @@ jobs:
             type=ref,event=tag
             type=raw,value=latest,enable={{is_default_branch}}
       - name: Login to DockerHub
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
+        if: steps.check-dockerhub-secrets.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and push to DockerHub
-        if: steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
+        if: steps.check-dockerhub-secrets.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
         uses: docker/build-push-action@v7
         with:
           context: ./packages