diff --git a/changelog.d/maintenance/8967-remove-fork-publish-workflows.md b/changelog.d/maintenance/8967-remove-fork-publish-workflows.md
new file mode 100644
index 0000000000..d07d91980a
--- /dev/null
+++ b/changelog.d/maintenance/8967-remove-fork-publish-workflows.md
@@ -0,0 +1 @@
+- **chore(ci):** removed two fork-owned image-publish workflows that had ridden into the repo as unrelated extra files in on-topic PRs — `build-fork.yml` (`ghcr.io/kang-heewon`, job-level guard, so it instantiated a skipped run on every push to main and every tag) and `build-rinseaid-image.yml` (`ghcr.io/rinseaid`, no guard, never fired). Neither could authenticate against this repository's token; a new policy guard now fails CI on any workflow targeting a foreign registry namespace ([#8967](https://github.com/diegosouzapw/OmniRoute/pull/8967))