diff --git a/.github/workflows/pypi-release.yml b/.github/workflows/pypi-release.yml
index c92e8892d..25845c25e 100644
--- a/.github/workflows/pypi-release.yml
+++ b/.github/workflows/pypi-release.yml
@@ -31,6 +31,7 @@ jobs:
         name: picard-sdist
         path: dist/*
     - name: Prepare GPG signing key
+      if: startsWith(github.ref, 'refs/tags/')
       run: |
         if [ -n "$CODESIGN_PGP_URL" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
           pip3 install awscli
@@ -104,6 +105,7 @@ jobs:
         name: picard-bdist-${{ runner.os }}
         path: dist/*.whl
     - name: Prepare GPG signing key
+      if: startsWith(github.ref, 'refs/tags/')
       run: |
         if [ -n "$CODESIGN_PGP_URL" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
           pip3 install awscli