diff --git a/.config/tend.yaml b/.config/tend.yaml
index 114e6c201605..69751644747d 100644
--- a/.config/tend.yaml
+++ b/.config/tend.yaml
@@ -2,7 +2,9 @@ bot_name: prql-bot
 secrets:
   # Docker Hub login is needed by test-rust.yaml on internal PRs (external-DB
   # tests); it's a low-value pull token, so it's intentionally repo-level.
-  # Release secrets (cargo/snapcraft) live in the `release` environment instead.
+  # Everything else sits behind an environment, split by the ref that releases
+  # it: `tend` for the jobs that run on `main`, `release` for the ones that run
+  # on a tag.
   allowed:
     - DOCKERHUB_TOKEN
     - DOCKERHUB_USERNAME
diff --git a/.github/workflows/pull-request-target.yaml b/.github/workflows/pull-request-target.yaml
index e20064f5701b..c0e949514c93 100644
--- a/.github/workflows/pull-request-target.yaml
+++ b/.github/workflows/pull-request-target.yaml
@@ -51,6 +51,7 @@ jobs:
     # Confirm that it's merged and has a label to ensure nothing is backported without oversight
     if: |
       github.event.pull_request.merged
+      && github.event.pull_request.base.ref == 'main'
       && (
         github.event.action == 'closed'
         || (
@@ -58,6 +59,12 @@ jobs:
           && contains(github.event.label.name, 'pr-backport-web')
         )
       )
+    # `pull_request_target` runs at the base branch's ref, and `TEND_BOT_TOKEN`
+    # lives in the `tend` environment, which admits only `main`. Hence the
+    # `base.ref` condition above.
+    environment:
+      name: tend
+      deployment: false
     steps:
       - uses: tibdex/backport@v2
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3235ee007581..daed59ec26bb 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,6 +23,7 @@ jobs:
   brew-dispatcher:
     name: Release on homebrew-prql
     runs-on: ubuntu-24.04
+    environment: release
     if: github.event_name == 'release'
     steps:
       - uses: actions/github-script@v9
@@ -124,6 +125,7 @@ jobs:
 
   publish-winget:
     runs-on: ubuntu-24.04
+    environment: release
     needs: build-prqlc
     if: github.event_name == 'release'
     steps:
@@ -426,6 +428,7 @@ jobs:
 
   push-web-branch:
     runs-on: ubuntu-24.04
+    environment: release
     if: github.event_name == 'release'
     steps:
       - name: 📂 Checkout code
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 9afee0405504..5c4901b87adc 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -783,6 +783,12 @@ jobs:
     # default toolchain to run on. The minimum is defined by Cargo.toml's
     # metadata.msrv and is updated manually based on when build environments
     # such as debian & winget are updated.
+    #
+    # `TEND_BOT_TOKEN` lives in the `tend` environment, which admits only
+    # `main`; `nightly-upstream` is schedule-only, so the ref is always `main`.
+    environment:
+      name: tend
+      deployment: false
     steps:
       - name: 📂 Checkout code
         uses: actions/checkout@v7