diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5c9fcd9..5ad24e0 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -3,8 +3,9 @@ name: Docker Image
 on:
   schedule:
     - cron: "0 12 * * *" # everyday at 12pm
+  pull_request:
   push:
-    branches: ["**"]
+    branches: ["latest"]
     tags: ["v*.*.*"]
 
 env:
@@ -33,6 +34,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Login to Docker Hub
+        if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -45,4 +47,3 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-
diff --git a/README.md b/README.md
index 96773e6..e1d0c72 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,12 @@ docker build -t beevelop/ionic github.com/beevelop/docker-ionic
 FROM beevelop/ionic:v2025.08.1
 ```
 
+## CI
+
+Pull requests build the Docker image without logging in to Docker Hub or pushing
+images. Pushes to `latest`, version tags matching `v*.*.*`, and scheduled runs log
+in and publish images.
+
 ---
 
 # All Docker images