diff --git a/.cirrus.yml b/.cirrus.yml
index 7f8726372b..b79ce9b319 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -52,14 +52,19 @@ sanitizers_resource_template: &SANITIZERS_RESOURCE_TEMPLATE
   greedy: true
 
 ci_template: &CI_TEMPLATE
+  # Rules for skipping builds:
+  # - Don't do darwin builds on zeek-security repo because they use up a ton of compute credits.
+  # - Always build PRs, but not if they come from dependabot
+  # - Always build master and release/* builds from the main repo
   only_if: >
-    ( $CIRRUS_PR != '' && $CIRRUS_BRANCH !=~ 'dependabot/.*' ) ||
+    ( $CIRRUS_REPO_NAME != 'zeek-security' || $CIRRUS_OS != "darwin" ) &&
+    ( ( $CIRRUS_PR != '' && $CIRRUS_BRANCH !=~ 'dependabot/.*' ) ||
     ( $CIRRUS_REPO_NAME == 'zeek' &&
       (
       $CIRRUS_BRANCH == 'master' ||
       $CIRRUS_BRANCH =~ 'release/.*'
       )
-    )
+    ) )
 
   # Default timeout is 60 minutes, Cirrus hard limit is 120 minutes for free
   # tasks, so may as well ask for full time.
diff --git a/CHANGES b/CHANGES
index 1e2c6b667a..634b5b2518 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5.2.0-dev.15 | 2022-09-23 13:33:16 -0700
+
+  * Skip darwin builds on zeek-security repo (Tim Wojtulewicz, Corelight)
+
 5.2.0-dev.12 | 2022-09-20 21:11:02 -0700
 
   * scripts/conn: Open-code determine_service() (Arne Welzel, Corelight)
diff --git a/VERSION b/VERSION
index 14ca4f3653..e5aa08bb27 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.2.0-dev.12
+5.2.0-dev.15