Securing Release Pipelines in Github Actions? How?

Question

I have a release workflow that does a promotion to heroku from Staging to Prod, but only certain people can run that in the Main branch, but the thing is that if somebody does a checkout on the main branch and they create their branch they will be able to modify the release.yaml workflow and run that workflow from their branch at the Action section in Github, and technically do a release, because the branch has access to Secret Vars? - Did any of you resolve this problem, other than creating specific repos just for this activity.