diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index 72eadc8073..714d2ed8a6 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -52,6 +52,11 @@ variables:
     - if: '$CI_PIPELINE_SOURCE == "schedule"'
       when: never
 
+    # macOS jobs can't run in forks until gitlab opens up runner availability
+    # to all tiers https://gitlab.com/groups/gitlab-org/-/work_items/8267
+    - if: '$QEMU_JOB_MACOS == "1" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+      when: never
+
     # Publishing jobs should only run on the default branch in upstream
     - if: '$QEMU_JOB_PUBLISH == "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
diff --git a/.gitlab-ci.d/macos.yml b/.gitlab-ci.d/macos.yml
index 8366b4ad56..84ad2492ca 100644
--- a/.gitlab-ci.d/macos.yml
+++ b/.gitlab-ci.d/macos.yml
@@ -36,6 +36,7 @@ aarch64-macos-15-build:
   extends: .macos_job_template
   image: macos-15-xcode-16
   variables:
+    QEMU_JOB_MACOS: 1
     NAME: macos-15
     PATH_EXTRA: /opt/homebrew/gettext/bin
     PKG_CONFIG_PATH: /opt/homebrew/curl/lib/pkgconfig:/opt/homebrew/ncurses/lib/pkgconfig:/opt/homebrew/readline/lib/pkgconfig
@@ -52,6 +53,7 @@ aarch64-macos-26-build:
   extends: .macos_job_template
   image: macos-26-xcode-26
   variables:
+    QEMU_JOB_MACOS: 1
     NAME: macos-26
     DYLD_LIBRARY_PATH: /opt/homebrew/opt/expat/lib/
     PATH_EXTRA: /opt/homebrew/gettext/bin
diff --git a/docs/devel/testing/ci-jobs.rst.inc b/docs/devel/testing/ci-jobs.rst.inc
index d5b081978a..d747a7ad13 100644
--- a/docs/devel/testing/ci-jobs.rst.inc
+++ b/docs/devel/testing/ci-jobs.rst.inc
@@ -125,6 +125,13 @@ QEMU_JOB_FUNCTIONAL
 
 The job runs the functional test suite
 
+QEMU_JOB_MACOS
+~~~~~~~~~~~~~~
+
+The job requires access to the macOS shared runners, which are
+only available to Premium/Ultimate tiers. This includes OSS project
+members, but not forks.
+
 Contributor controlled runtime variables
 ----------------------------------------