diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index f09031696395..c57a76da94fb 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -10,6 +10,7 @@
 
 ## Checklist
 
+- [ ] The PR targets `develop` (`main` only moves through release PRs)
 - [ ] `python -m app.validate` passes locally
 - [ ] Files live at the correct `data/<category>/<...>/<slug>.json` path
 - [ ] Slugs are kebab-case and unique within the category
diff --git a/.github/workflows/bump-engine.yml b/.github/workflows/bump-engine.yml
index b2beb8d0c3c7..aa06e4a97ef7 100644
--- a/.github/workflows/bump-engine.yml
+++ b/.github/workflows/bump-engine.yml
@@ -20,6 +20,9 @@ concurrency:
 
 jobs:
   bump:
+    # Org-only: this job publishes the site or talks to TechEngine. In a fork
+    # it can only fail (no secrets, no Pages), so it does not run there.
+    if: github.repository == 'GetTechAPI/TechAPI'
     runs-on: ubuntu-latest
     env:
       ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }}
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 07c1cea2d04c..c258e4bad898 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -21,6 +21,9 @@ concurrency:
 
 jobs:
   build:
+    # Org-only: this job publishes the site or talks to TechEngine. In a fork
+    # it can only fail (no secrets, no Pages), so it does not run there.
+    if: github.repository == 'GetTechAPI/TechAPI'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/notify-engine.yml b/.github/workflows/notify-engine.yml
index 07af296c1eef..e810378aafde 100644
--- a/.github/workflows/notify-engine.yml
+++ b/.github/workflows/notify-engine.yml
@@ -27,6 +27,9 @@ permissions:
 
 jobs:
   notify:
+    # Org-only: this job publishes the site or talks to TechEngine. In a fork
+    # it can only fail (no secrets, no Pages), so it does not run there.
+    if: github.repository == 'GetTechAPI/TechAPI'
     runs-on: ubuntu-latest
     env:
       ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }}
diff --git a/README.md b/README.md
index 912c8354c25d..2d6e04f0b261 100644
--- a/README.md
+++ b/README.md
@@ -62,12 +62,14 @@ submodule bump and the verified-promotion bot both land on `develop`.
 
 ## Contributing
 
-Open a PR **against `develop`** with the new/updated JSON file. The PR template
-walks through what to include. The validator must pass. All records (`brand`,
-`soc`, `smartphone`, `gpu`, and `cpu`) must include `source_urls` with at least
-one canonical reference (vendor product page, Wikipedia infobox, datasheet).
+Open a PR **against `develop`** with the new/updated JSON file — that is also
+the default branch, so a PR from a fork targets it automatically. The PR
+template walks through what to include, and the validator must pass. Every
+record, in every category, must include `source_urls` with at least one
+canonical reference (vendor product page, Wikipedia infobox, datasheet).
 
 ## License
 
-Data is licensed **CC-BY-SA 4.0**; attribute "Data from TechAPI" and share alike.
+Data is licensed **CC-BY-SA 4.0**; attribute "Data from TechAPI" and share alike
+(see [`data/LICENSE.md`](data/LICENSE.md)).
 The bundled validator code is [MIT](LICENSE).
diff --git a/data/LICENSE.md b/data/LICENSE.md
new file mode 100644
index 000000000000..b34b068f0eb1
--- /dev/null
+++ b/data/LICENSE.md
@@ -0,0 +1,15 @@
+# Data license
+
+The dataset in this directory (`data/**`), and the static JSON API generated
+from it (`site/public/v1/**`), are licensed under **Creative Commons
+Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)**:
+<https://creativecommons.org/licenses/by-sa/4.0/>
+
+When you reuse the data, attribute it as "Data from TechAPI" with a link to
+<https://github.com/GetTechAPI/TechAPI>, and release derived datasets under the
+same license. Each record also lists the sources it was compiled from in its
+`source_urls` field.
+
+This notice restates the license declared in the top-level `README.md`. The
+code in this repository — the validator, the site and the workflows — is
+licensed separately under MIT; see [`../LICENSE`](../LICENSE).