diff --git a/bin/core/src/api/read/build.rs b/bin/core/src/api/read/build.rs
index 178aad9e5..e56208454 100644
--- a/bin/core/src/api/read/build.rs
+++ b/bin/core/src/api/read/build.rs
@@ -329,11 +329,29 @@ impl Resolve<GetBuildWebhookEnabled, User> for State {
     .await?;
 
     if build.config.repo.is_empty() {
-      return Ok(GetBuildWebhookEnabledResponse { enabled: false });
+      return Ok(GetBuildWebhookEnabledResponse {
+        managed: false,
+        enabled: false,
+      });
     }
 
     let mut split = build.config.repo.split('/');
     let owner = split.next().context("Build repo has no owner")?;
+
+    let CoreConfig {
+      host,
+      github_webhook_base_url,
+      github_webhook_app,
+      ..
+    } = core_config();
+
+    if !github_webhook_app.owners.iter().any(|o| o == owner) {
+      return Ok(GetBuildWebhookEnabledResponse {
+        managed: false,
+        enabled: false,
+      });
+    }
+
     let repo =
       split.next().context("Build repo has no repo after the /")?;
 
@@ -344,20 +362,21 @@ impl Resolve<GetBuildWebhookEnabled, User> for State {
       .context("failed to list all webhooks on repo")?
       .body;
 
-    let CoreConfig {
-      host,
-      github_webhook_base_url,
-      ..
-    } = core_config();
     let host = github_webhook_base_url.as_ref().unwrap_or(host);
     let url = format!("{host}/listener/github/build/{}", build.id);
 
     for webhook in webhooks {
       if webhook.active && webhook.config.url == url {
-        return Ok(GetBuildWebhookEnabledResponse { enabled: true });
+        return Ok(GetBuildWebhookEnabledResponse {
+          managed: true,
+          enabled: true,
+        });
       }
     }
 
-    Ok(GetBuildWebhookEnabledResponse { enabled: false })
+    Ok(GetBuildWebhookEnabledResponse {
+      managed: true,
+      enabled: false,
+    })
   }
 }
diff --git a/bin/core/src/api/read/repo.rs b/bin/core/src/api/read/repo.rs
index 0e3f8ee1a..ac9202118 100644
--- a/bin/core/src/api/read/repo.rs
+++ b/bin/core/src/api/read/repo.rs
@@ -140,6 +140,7 @@ impl Resolve<GetRepoWebhooksEnabled, User> for State {
 
     if repo.config.repo.is_empty() {
       return Ok(GetRepoWebhooksEnabledResponse {
+        managed: false,
         clone_enabled: false,
         pull_enabled: false,
       });
@@ -147,6 +148,22 @@ impl Resolve<GetRepoWebhooksEnabled, User> for State {
 
     let mut split = repo.config.repo.split('/');
     let owner = split.next().context("Repo repo has no owner")?;
+
+    let CoreConfig {
+      host,
+      github_webhook_base_url,
+      github_webhook_app,
+      ..
+    } = core_config();
+
+    if !github_webhook_app.owners.iter().any(|o| o == owner) {
+      return Ok(GetRepoWebhooksEnabledResponse {
+        managed: false,
+        clone_enabled: false,
+        pull_enabled: false,
+      });
+    }
+
     let repo_name =
       split.next().context("Repo repo has no repo after the /")?;
 
@@ -157,11 +174,6 @@ impl Resolve<GetRepoWebhooksEnabled, User> for State {
       .context("failed to list all webhooks on repo")?
       .body;
 
-    let CoreConfig {
-      host,
-      github_webhook_base_url,
-      ..
-    } = core_config();
     let host = github_webhook_base_url.as_ref().unwrap_or(host);
     let clone_url =
       format!("{host}/listener/github/repo/{}/clone", repo.id);
@@ -181,6 +193,7 @@ impl Resolve<GetRepoWebhooksEnabled, User> for State {
     }
 
     Ok(GetRepoWebhooksEnabledResponse {
+      managed: true,
       clone_enabled,
       pull_enabled,
     })
diff --git a/bin/core/src/config.rs b/bin/core/src/config.rs
index f62e83122..619cb8590 100644
--- a/bin/core/src/config.rs
+++ b/bin/core/src/config.rs
@@ -116,6 +116,9 @@ pub fn core_config() -> &'static CoreConfig {
         installation_id: env
           .monitor_github_webhook_app_installation_id
           .unwrap_or(config.github_webhook_app.installation_id),
+        owners: env
+          .monitor_github_webhook_app_owners
+          .unwrap_or(config.github_webhook_app.owners),
         pk_path: env
           .monitor_github_webhook_app_pk_path
           .unwrap_or(config.github_webhook_app.pk_path),
diff --git a/bin/core/src/state.rs b/bin/core/src/state.rs
index 1353a1067..6ff04a95a 100644
--- a/bin/core/src/state.rs
+++ b/bin/core/src/state.rs
@@ -54,6 +54,7 @@ pub fn github_client() -> Option<&'static octorust::Client> {
             app_id,
             installation_id,
             pk_path,
+            ..
           },
         ..
       } = core_config();
diff --git a/client/core/rs/src/api/read/build.rs b/client/core/rs/src/api/read/build.rs
index 778e615e2..53343f2f1 100644
--- a/client/core/rs/src/api/read/build.rs
+++ b/client/core/rs/src/api/read/build.rs
@@ -280,6 +280,9 @@ pub struct GetBuildWebhookEnabled {
 #[typeshare]
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct GetBuildWebhookEnabledResponse {
-  /// Whether pushes to branch trigger build
+  /// Whether the repo webhooks can even be managed.
+  /// The repo owner must be in `github_webhook_app.owners` list to be managed.
+  pub managed: bool,
+  /// Whether pushes to branch trigger build. Will always be false if managed is false.
   pub enabled: bool,
 }
diff --git a/client/core/rs/src/api/read/repo.rs b/client/core/rs/src/api/read/repo.rs
index ddf3c4695..dcc5cbaa1 100644
--- a/client/core/rs/src/api/read/repo.rs
+++ b/client/core/rs/src/api/read/repo.rs
@@ -132,8 +132,11 @@ pub struct GetRepoWebhooksEnabled {
 #[typeshare]
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct GetRepoWebhooksEnabledResponse {
-  /// Whether pushes to branch trigger clone
+  /// Whether the repo webhooks can even be managed.
+  /// The repo owner must be in `github_webhook_app.owners` list to be managed.
+  pub managed: bool,
+  /// Whether pushes to branch trigger clone. Will always be false if managed is false.
   pub clone_enabled: bool,
-  /// Whether pushes to branch trigger pull
+  /// Whether pushes to branch trigger pull. Will always be false if managed is false.
   pub pull_enabled: bool,
 }
diff --git a/client/core/rs/src/entities/config/core.rs b/client/core/rs/src/entities/config/core.rs
index 392f03b72..811f47e62 100644
--- a/client/core/rs/src/entities/config/core.rs
+++ b/client/core/rs/src/entities/config/core.rs
@@ -97,6 +97,8 @@ pub struct Env {
   pub monitor_github_webhook_app_app_id: Option<i64>,
   /// Override `github_webhook_app.installation_id`
   pub monitor_github_webhook_app_installation_id: Option<i64>,
+  /// Override `github_webhook_app.owners`. Accepts comma seperated list.
+  pub monitor_github_webhook_app_owners: Option<Vec<String>>,
   /// Override `github_webhook_app.pk_path`
   pub monitor_github_webhook_app_pk_path: Option<String>,
 
@@ -230,6 +232,7 @@ fn default_config_path() -> String {
 /// ## Configure github webhook app. Enables webhook management apis.
 /// # github_webhook_app.app_id = 1234455 # Find on the app page.
 /// # github_webhook_app.installation_id = 1234455 # Get after installing the app to user / organization.
+/// # github_webhook_app.owners = ["mbecker20"] # List of the repo owners which the app has access to.
 ///
 /// ## Path to github webhook app private key.
 /// ## This is defaulted to `/github-private-key.pem`, and doesn't need to be changed if running in Docker.
@@ -596,6 +599,8 @@ pub struct GithubWebhookAppConfig {
   pub app_id: i64,
   /// Github app installation id
   pub installation_id: i64,
+  /// List of the repo owners which the app has access to.
+  pub owners: Vec<String>,
   /// Private key path. Default: /github-private-key.pem.
   #[serde(default = "default_private_key_path")]
   pub pk_path: String,
@@ -610,6 +615,7 @@ impl Default for GithubWebhookAppConfig {
     GithubWebhookAppConfig {
       app_id: 0,
       installation_id: 0,
+      owners: Default::default(),
       pk_path: default_private_key_path(),
     }
   }