diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 60cd833014..272ca1fbc8 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -898,6 +898,13 @@ pub async fn drop_forked_datatable_databases(
             == windmill_common::workspaces::DataTableCatalogResourceType::Instance
         {
             let db_to_drop = &dt.database.resource_path;
+            if !db_to_drop.starts_with("wm_fork_") {
+                errors.push(format!(
+                    "Refusing to drop instance database '{}' for datatable://{}:  name does not start with 'wm_fork_'",
+                    db_to_drop, dt_name
+                ));
+                continue;
+            }
             if let Err(e) = windmill_common::drop_custom_instance_database(&db, db_to_drop).await {
                 errors.push(format!(
                     "Could not drop instance database '{}' for datatable://{}: {}",
@@ -946,6 +953,13 @@ pub async fn drop_forked_datatable_databases(
                 ));
                 continue;
             }
+            if !db_to_drop.starts_with("wm_fork_") {
+                errors.push(format!(
+                    "Refusing to drop resource database '{}' for datatable://{}: name does not start with 'wm_fork_'",
+                    db_to_drop, dt_name
+                ));
+                continue;
+            }
 
             match parent_pg.connect().await {
                 Ok((client, connection)) => {