diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 008c830..e78de37 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,8 +5,12 @@ on:
 
 jobs:
   build:
-    # only run in forks — non-fork PRs get a build via preview-deployment.yml
-    if: github.event.pull_request.head.repo.full_name != github.repository
+    # Runs wherever preview-deployment.yml cannot. Fork PRs and Dependabot PRs
+    # both get a read-only GITHUB_TOKEN with no access to secrets, so the
+    # preview deploy fails on them; this plain build is their only check.
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.repository ||
+      github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml
index 64b19f9..2c5c339 100644
--- a/.github/workflows/pr-cleanup.yml
+++ b/.github/workflows/pr-cleanup.yml
@@ -5,8 +5,11 @@ on:
 
 jobs:
   release_preview_canister:
-    # do not run in forks
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Mirror preview-deployment.yml: only PRs that got a preview canister have
+    # one to release. Fork and Dependabot PRs never allocate one.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     concurrency:
       group: pr-${{ github.event.pull_request.number || github.event.number }}
diff --git a/.github/workflows/preview-deployment.yml b/.github/workflows/preview-deployment.yml
index 0247506..3295900 100644
--- a/.github/workflows/preview-deployment.yml
+++ b/.github/workflows/preview-deployment.yml
@@ -5,8 +5,12 @@ on:
 
 jobs:
   build_and_deploy:
-    # do not run in forks
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Needs repo secrets and write access to post the preview comment, so skip
+    # any PR whose runs get a read-only token: forks and Dependabot. Those are
+    # covered by build.yml instead.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     concurrency:
       group: pr-${{ github.event.pull_request.number || github.event.number }}