diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1afe3fec..db8a29b1 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,3 +1,5 @@
+version: 2.1
+
 workflows:
   version: 2
   node-multi-build:
@@ -5,7 +7,21 @@ workflows:
       - node-v10
       - node-v12
 
-version: 2
+commands:
+  early_return_for_forked_pull_requests:
+    description: >-
+      If this build is from a fork, stop executing the current job and return success.
+      This is useful to avoid steps that will fail due to missing credentials.
+      See https://circleci.com/blog/continuous-deployment-of-an-express-graphql-server-to-heroku/
+    steps:
+      - run:
+          name: Early return if this build is from a forked PR
+          command: |
+            if [ -n "$CIRCLE_PR_NUMBER" ]; then
+              echo "Nothing to do for forked PRs, so marking this step successful"
+              circleci step halt
+            fi
+
 jobs:
   node-base: &node-base
     docker:
@@ -31,6 +47,11 @@ jobs:
             CLOSURE_VER=20190325
             npm i "google-closure-deps@${CLOSURE_VER}"
             npm run unit
+      - save_cache:
+          key: v{{ .Environment.CIRCLE_CACHE_VERSION }}-npm-cache-{{ .Branch }}-{{ .Environment.CIRCLE_JOB }}-{{ checksum "package-lock.json" }}
+          paths:
+            - ~/.npm
+      - early_return_for_forked_pull_requests
       - run:
           name: Report coverage to coveralls.io
           command: |
@@ -39,10 +60,6 @@ jobs:
             else
               echo "Skip reporting coverage"
             fi
-      - save_cache:
-          key: v{{ .Environment.CIRCLE_CACHE_VERSION }}-npm-cache-{{ .Branch }}-{{ .Environment.CIRCLE_JOB }}-{{ checksum "package-lock.json" }}
-          paths:
-            - ~/.npm
 
   node-v10:
     <<: *node-base