diff --git a/backlog.tasks b/backlog.tasks
index b0e2ff0..cba9f7e 100644
--- a/backlog.tasks
+++ b/backlog.tasks
@@ -54,3 +54,9 @@ Maintenance:
     ✔ Guard the invariant in CI (`Assert the baked tool cache is present`) @done
 ☐ Enable force-pull for the runner so a changed act-ci image is never missed @low
     → the tag encodes only the Node version, so a Dockerfile change yields new content under an unchanged tag; with `forcePull=false` the runner keeps the old image (see CONTRIBUTING § CI runner image)
+☐ Improve CI publish
+    ☐ Check whether publish job is only run on tags, if not, guard it
+    ☐ Gate only single steps
+        ☐ Do not publish to npm, if NPM_TOKEN is not set (e.g. PRs from forks)
+        ☐ Do not publish to Gitea, if GITEA_TOKEN is not set (e.g. PRs from forks)
+        ☐ Otherwise run the steps