diff --git a/.github/workflows/android.publish.firebase.yml b/.github/workflows/android.preview.firebase.yml
similarity index 90%
rename from .github/workflows/android.publish.firebase.yml
rename to .github/workflows/android.preview.firebase.yml
index 302059a80..1f2bbb308 100644
--- a/.github/workflows/android.publish.firebase.yml
+++ b/.github/workflows/android.preview.firebase.yml
@@ -1,17 +1,26 @@
 name: Notesnook Android Preview
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, synchronize]
     branches: [master, beta]
     paths:
       - "apps/mobile/**"
       - "packages/**"
-      # re-run workflow if workflow file changes
-      - ".github/workflows/mobile.publish.firebase.yml"
+      - ".github/workflows/android.preview.firebase.yml"
 
 jobs:
+  authorize:
+    environment: ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo true
+
   build:
+    needs: authorize
     runs-on: ubuntu-22.04
     env:
       STAGING_BUILD: true
@@ -19,6 +28,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Setup Node
         uses: ./.github/actions/setup-node-with-cache
diff --git a/.github/workflows/ios.preview.firebase.yml b/.github/workflows/ios.preview.firebase.yml
index 6e8975a19..b3efaf1cf 100644
--- a/.github/workflows/ios.preview.firebase.yml
+++ b/.github/workflows/ios.preview.firebase.yml
@@ -1,23 +1,34 @@
 name: Notesnook iOS Preview
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, synchronize]
     branches: [master, beta]
     paths:
       - "apps/mobile/**"
       - "packages/**"
-      # re-run workflow if workflow file changes
       - ".github/workflows/ios.preview.firebase.yml"
 
 jobs:
+  authorize:
+    environment: ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo true
+
   build:
+    needs: authorize
     runs-on: macos-26
     timeout-minutes: 60
 
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Setup Node
         uses: ./.github/actions/setup-node-with-cache