diff --git a/.github/workflows/core.tests.yml b/.github/workflows/core.tests.yml
index 96596e36c..c5b813871 100644
--- a/.github/workflows/core.tests.yml
+++ b/.github/workflows/core.tests.yml
@@ -9,7 +9,7 @@ on:
       - "packages/core/**"
       # re-run workflow if workflow file changes
       - ".github/workflows/core.tests.yml"
-  pull_request:
+  pull_request_target:
     branches:
       - "master"
     paths:
@@ -23,9 +23,17 @@ on:
       - "reopened"
 
 jobs:
-  test:
-    runs-on: ubuntu-22.04
+  authorize:
+    environment: ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo true
 
+  test:
+    needs: authorize
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/web.tests.yml b/.github/workflows/web.tests.yml
index 21430f710..665d6c7e1 100644
--- a/.github/workflows/web.tests.yml
+++ b/.github/workflows/web.tests.yml
@@ -9,7 +9,7 @@ on:
       - "apps/web/**"
       # re-run workflow if workflow file changes
       - ".github/workflows/web.tests.yml"
-  pull_request:
+  pull_request_target:
     branches:
       - "master"
     paths:
@@ -23,7 +23,16 @@ on:
       - "reopened"
 
 jobs:
+  authorize:
+    environment: ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo true
+
   build:
+    needs: authorize
     name: Build
     runs-on: ubuntu-22.04
     steps: