diff --git a/.github/workflows/mirror-changelog.yml b/.github/workflows/mirror-changelog.yml
index 3df81b9..58e457e 100644
--- a/.github/workflows/mirror-changelog.yml
+++ b/.github/workflows/mirror-changelog.yml
@@ -15,7 +15,8 @@
 name: Mirror Toolbox Changelog
 
 on:
-  pull_request:
+  # Fork Renovate PRs need a write token; safe (no PR-code checkout, API-only).
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, edited]
 
 jobs: