diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a1a9442914826..b8dbe5a4feea5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,6 +30,10 @@ on:
         description: "Should we run the opt-in steps?"
         default: "false"
         type: string
+      is-public-fork:
+        description: "Is this CI run from a public fork?"
+        default: "true"
+        type: string
 
 jobs:
   validate:
@@ -110,7 +114,8 @@ jobs:
         id: junit-test
         run: |
           set +e
-          timeout 180m ./gradlew --build-cache --scan --continue \
+          timeout 180m ./gradlew --build-cache --continue \
+          ${{ inputs.is-public-fork == 'true' && '--no-scan' || '--scan' }} \
           -PtestLoggingEvents=started,passed,skipped,failed \
           -PmaxParallelForks=2 \
           -PmaxTestRetries=1 -PmaxTestRetryFailures=10 \
@@ -132,3 +137,9 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           REPORT_URL: ${{ steps.junit-upload-artifact.outputs.artifact-url }}
           GRADLE_EXIT_CODE: ${{ steps.junit-test.outputs.exitcode }}
+      - name: Archive Build Scan
+        if: ${{ inputs.is-public-fork == 'true' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-scan-test-${{ matrix.java }}
+          path: ~/.gradle/build-scan-data
diff --git a/.github/workflows/ci-complete.yml b/.github/workflows/ci-complete.yml
new file mode 100644
index 0000000000000..73de8fcf4d19f
--- /dev/null
+++ b/.github/workflows/ci-complete.yml
@@ -0,0 +1,54 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: CI Complete
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types:
+      - completed
+
+jobs:
+  upload-build-scan:
+    if: ${{ github.event.workflow_run.head_repository.full_name != 'apache/kafka' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        java: [ 21, 17, 11, 8 ]
+    steps:
+      - name: Env
+        run: printenv
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials:
+            false
+      - name: Setup Gradle
+        uses: ./.github/actions/setup-gradle
+        with:
+          java-version: ${{ matrix.java }}
+          develocity-access-key: ${{ secrets.GE_ACCESS_TOKEN }}
+      - uses: actions/download-artifact@v4
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ github.event.workflow_run.id }}
+          name: build-scan-test-${{ matrix.java }}
+          path: ~/.gradle/build-scan-data
+      - name: Publish scan
+        run: ./gradlew --info buildScanPublishPrevious
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c0a3ca454980..8fa43d53670ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,5 +36,6 @@ jobs:
       gradle-cache-read-only: ${{ github.ref != 'refs/heads/trunk' }}
       gradle-cache-write-only: ${{ github.ref == 'refs/heads/trunk' }}
       github-actions-opt-in: ${{ github.ref == 'refs/heads/trunk' || contains(github.head_ref, 'gh-') }}
+      is-public-fork: ${{ github.event.pull_request.head.repo.full_name != 'apache/kafka' }}
     secrets:
       inherit