diff --git a/.github/workflows/dependabot_pr.yml b/.github/workflows/dependabot_pr.yml
deleted file mode 100644
index ad182c8f..00000000
--- a/.github/workflows/dependabot_pr.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-### .github/workflows/dependabot_pr.yml
-### This workflow doesn't have access to secrets and has a read-only token
-name: Dependabot PR Check
-on:
-  pull_request
-
-jobs:
-  check-dependabot:
-    runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    steps:
-      - run: echo "PR created by Dependabot"
\ No newline at end of file
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c1648b9f..9dd1ff7d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,10 +1,12 @@
 name: test
 
 on:
-  workflow_run:
-    workflows: ["Dependabot PR Check"]
-    types:
-      - completed
+  # No workflow_run trigger. It used to run this workflow again after the
+  # "Dependabot PR Check" workflow, to give build-linux the Docker Hub secrets
+  # that Dependabot's pull_request runs do not get. But a workflow_run run
+  # checks out the default branch, not the PR, so it never built the
+  # dependency bump. Checking out the PR there instead would build untrusted
+  # code with secrets. build-linux now runs on pull_request without secrets.
   pull_request:
     branches:
       - main
@@ -79,9 +81,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
 
+  # Runs on every pull request, including Dependabot and fork PRs, which get no
+  # secrets. A --snapshot build never pushes images ("snapshot build: will not
+  # push any images"), so Docker Hub credentials are only used to authenticate
+  # the pull of the public alpine base image. Log in when they are available and
+  # pull anonymously when they are not, rather than skipping the job: a skipped
+  # required check counts as passing.
   build-linux:
     runs-on: ubuntu-latest
-    if: ${{ github.actor != 'dependabot[bot]' || github.event.workflow_run.conclusion == 'success' }}
     env:
       # https://goreleaser.com/customization/docker_manifest/
       DOCKER_CLI_EXPERIMENTAL: "enabled"
@@ -90,7 +97,20 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      # A step's `if` cannot read `secrets` directly, so check for them here.
+      - name: Check for Docker Hub credentials
+        id: docker-creds
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: |
+          if [ -n "$DOCKER_USERNAME" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No Docker Hub credentials in this run (Dependabot or fork PR); pulling base images anonymously."
+          fi
       - name: Docker Login
+        if: steps.docker-creds.outputs.available == 'true'
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}