diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml
index 800aba3..0e00abd 100644
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -5,7 +5,8 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request_target:
+  # plain pull_request: fork runs get no secrets and a read-only token
+  pull_request:
 
 jobs:
   test: