diff --git a/.github/workflows/repo-hygiene.yml b/.github/workflows/repo-hygiene.yml
index 3c9e4bb..6f45c9a 100644
--- a/.github/workflows/repo-hygiene.yml
+++ b/.github/workflows/repo-hygiene.yml
@@ -55,8 +55,9 @@ jobs:
           ref: ${{ inputs.hygiene-revision }}
           path: .hygiene-tools
           persist-credentials: false
+      # The self-hosted runners carry Gitleaks; hosted ones need it installed.
       - name: Install pinned Gitleaks
-        if: github.event.pull_request.head.repo.fork
+        if: github.event.pull_request.head.repo.fork || github.repository_owner != 'itpplasma'
         run: |
           curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o "$RUNNER_TEMP/gitleaks.tar.gz"
           echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c -