diff --git a/.github/workflows/notify-slack-on-main-merge.yml b/.github/workflows/notify-slack-on-main-merge.yml
index 8fd459e..063a403 100644
--- a/.github/workflows/notify-slack-on-main-merge.yml
+++ b/.github/workflows/notify-slack-on-main-merge.yml
@@ -1,11 +1,11 @@
 name: Notify Slack on Merge to Main
 
 # Posts to Slack when a PR lands on main. Opening a PR notifies nobody.
-# pull_request_target runs this file from main with secrets, so merged PRs from
-# forks post too. Nothing from the PR is checked out or run; the title only
-# reaches the shell through an env var.
+# pull_request, not pull_request_target: GitHub blocks the latter in public
+# repos by default from December 2026. Fork PRs get no secrets here, so their
+# merges post nothing. The title only reaches the shell through an env var.
 on:
-  pull_request_target:
+  pull_request:
     types: [closed]
     branches: [main]
 
@@ -15,7 +15,10 @@ jobs:
   notify:
     name: Notify Slack
     runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.merged && vars.SLACK_CHANNEL_ID != '' }}
+    if: >-
+      github.event.pull_request.merged &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      vars.SLACK_CHANNEL_ID != ''
 
     steps:
       # Slack reads <, > and & as markup: escape them so a PR title cannot