diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 859b67c5fa..fdf7784580 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -68,7 +68,7 @@ jobs:
     name: Upload to PyPI (test)
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-22.04
-    if: github.event_name == 'push' && startsWith(github.ref_name, 'build-workflow')
+    if: github.repository == 'tornadoweb/tornado' && github.event_name == 'push' && startsWith(github.ref_name, 'build-workflow')
     steps:
       - uses: actions/download-artifact@v3
         with:
@@ -86,7 +86,7 @@ jobs:
     name: Upload to PyPI (prod)
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-22.04
-    if: github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
+    if: github.repository == 'tornadoweb/tornado' && github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
     steps:
       - uses: actions/download-artifact@v3
         with:
diff --git a/tornado/test/websocket_test.py b/tornado/test/websocket_test.py
index f90c5f2c0f..0a29ae6460 100644
--- a/tornado/test/websocket_test.py
+++ b/tornado/test/websocket_test.py
@@ -807,6 +807,7 @@ def test_client_ping(self):
             response = yield ws.read_message()
             self.assertEqual(response, "got ping")
         # TODO: test that the connection gets closed if ping responses stop.
+        ws.close()
 
 
 class ManualPingTest(WebSocketBaseTestCase):