diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 5c366ca..227bfec 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -144,8 +144,11 @@ jobs:
         if: env.PUSH == 'true'
         uses: aws-actions/amazon-ecr-login@v2
 
+      # Only a run that pushes logs in to AWS, so a run that only builds
+      # skips the lookup and always builds.
       - name: Checking if ${{ steps.tags.outputs.tag }} exists
         id: exists
+        if: env.PUSH == 'true'
         env:
           REPOSITORY: ${{ env.ECR_REPOSITORY }}
           TAG: ${{ steps.tags.outputs.tag }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 75eba0b..942668f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,15 @@ workflows at `@main`, so a change reaches every caller when it merges.
 Old callers keep `@v1`. Changes are listed under the date of the merge, in the
 format of [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 2026-11-11
+
+### Fixed
+
+- `image.yml`: a run that only builds, such as a pull request without the
+  label `push-image`, no longer looks up the image in ECR. It has no AWS
+  login, so on a runner without its own AWS credentials the lookup failed
+  the job with `NoCredentials`. Such a run now always builds.
+
 ## 2026-11-10
 
 The special cases of single repos move out of the shared workflows, and