diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ac7088958e..1ce6d048f8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -17,6 +17,10 @@ jobs:
     permissions:
       contents: read
       packages: write
+    env:
+      # We only push the resulting image when we are on release tag (i.e., the only time we have a push event) or on
+      # manual request via the workflow_dispatch event.
+      PUSH: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -96,6 +100,8 @@ jobs:
           IS_PR: ${{ github.event_name == 'pull_request' }}
       # Try to log in early. If this fails, there's no reason to perform the remaining steps
       - name: Log in to Docker Hub
+        # Only attempt to log in if we later attempt to push.
+        if: ${{ env.PUSH }}
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
@@ -108,10 +114,6 @@ jobs:
           platforms: linux/amd64,linux/arm64
       - name: Build and publish model-server Docker image
         uses: docker/build-push-action@v6
-        env:
-          # We only push the resulting image when we are on release tag (i.e., the only time we have a push event) or on
-          # manual request via the workflow_dispatch event.
-          PUSH: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' }}
         with:
           context: ./model-server
           file: ./model-server/Dockerfile