diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f1d43a38..db68abee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -145,7 +145,11 @@ jobs:
   switch-build:
     name: Switch fused build
     needs: switch-changes
-    if: needs.switch-changes.outputs.changed == 'true' && github.repository == 'bryanthaboi/gen1recomp'
+    if: >-
+      needs.switch-changes.outputs.changed == 'true'
+      && github.repository == 'bryanthaboi/gen1recomp'
+      && (github.event_name != 'pull_request'
+          || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ["self-hosted", "macOS"]
     steps:
       - uses: actions/checkout@v7
diff --git a/docs/switch-build.md b/docs/switch-build.md
index e4fbd4a3..33a4b330 100644
--- a/docs/switch-build.md
+++ b/docs/switch-build.md
@@ -142,8 +142,11 @@ runs:
    `luajit tests/switch_ci_workflows_test.lua`.
 2. **Fused NRO build** only on the **canonical** repository
    (`bryanthaboi/gen1recomp`), on the self-hosted Mac runner
-   (`scripts/build_switch.sh --fetch --fused`). Forks skip the fused job —
-   they still get the ubuntu selftest.
+   (`scripts/build_switch.sh --fetch --fused`), and only when the workflow
+   head is that repo (same-repo push/PR). **Fork repository** CI never runs
+   fused. **Fork → canonical PRs** also skip Switch fused (offline selftest
+   still runs) so untrusted head code is not executed on the self-hosted Mac;
+   iOS device build eligibility is unchanged.
 3. On successful PR fused builds, a follow-up workflow posts a PR comment
    linking the Actions artifact named `gen1recomp-switch-nro`
    (comment tag `switch-build-result`; see
diff --git a/tests/switch_ci_workflows_test.lua b/tests/switch_ci_workflows_test.lua
index e5433296..9d200397 100644
--- a/tests/switch_ci_workflows_test.lua
+++ b/tests/switch_ci_workflows_test.lua
@@ -83,12 +83,24 @@ do
   mustContain(block, "if-no-files-found: error", "switch-build")
   mustContain(block, "retention-days: 7", "switch-build")
   mustNotContain(block, "continue-on-error:", "switch-build")
-  -- Forks must not run fused: canonical repo guard is required on the job if
+  -- SWFIX-04: same-repo head only (skip fork→canonical PRs on self-hosted)
+  mustContain(block, "pull_request.head.repo.full_name", "switch-build fork-PR skip")
+  mustContain(block, "github.event_name != 'pull_request'", "switch-build non-PR allow")
   check(block:find("bryanthaboi/gen1recomp", 1, true) ~= nil
     and block:find("changed == 'true'", 1, true) ~= nil,
     "switch-build requires changed=true AND canonical repository")
 end
 
+-- SWFIX-04 / M7: iOS build must NOT gain the Switch fork-PR head.repo guard
+do
+  local start = ci:find("ios-build:", 1, true)
+  check(start ~= nil, "ios-build job present")
+  local rest = ci:sub(start)
+  local nextJob = rest:find("\n  [%w_-]+:", 2)
+  local block = nextJob and rest:sub(1, nextJob - 1) or rest
+  mustNotContain(block, "pull_request.head.repo.full_name", "ios-build")
+end
+
 -- --- SWCI-06 / SWCI-07 / SWFIX-01: PR artifact comment (no delete-all clobber) ---
 mustContain(comment_wf, "workflows: [ci]", "switch-artifact-comment")
 mustContain(comment_wf, "gen1recomp-switch-nro", "switch-artifact-comment")
@@ -128,7 +140,8 @@ mustContain(build_doc, "hard gate", "switch-build.md")
 mustContain(build_doc, "continue-on-error", "switch-build.md")
 mustContain(build_doc, "nacptool", "switch-build.md")
 mustContain(build_doc, "Docker", "switch-build.md")
-mustContain(build_doc, "Forks skip", "switch-build.md")
+mustContain(build_doc, "Fork → canonical", "switch-build.md")
+mustContain(build_doc, "skip Switch fused", "switch-build.md")
 
 mustContain(development, "Switch CI", "switch-development.md")
 mustContain(development, "selftest_build_switch.sh", "switch-development.md")