diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c67ed0a..b37e2703 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ env:
 
 jobs:
   go-test:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Go Test
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -37,7 +37,7 @@ jobs:
         run: go test ./...
 
   go-build:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Go Build
     runs-on: ubuntu-latest
     needs: go-test
@@ -68,7 +68,7 @@ jobs:
           if-no-files-found: error
 
   sdk-typecheck:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: SDK Typecheck
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -111,7 +111,7 @@ jobs:
         run: npm run test:bundle:bun --workspace=packages/sdk/typescript
 
   client-typecheck:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Client Typecheck
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -144,7 +144,7 @@ jobs:
         run: npm run test --workspace=@relayfile/client
 
   e2e:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: E2E
     runs-on: ubuntu-latest
     needs: go-build
@@ -184,7 +184,7 @@ jobs:
           npx tsx scripts/e2e.ts --ci
 
   backend-conformance:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Backend Conformance (Go oracle)
     runs-on: ubuntu-latest
     timeout-minutes: 25
@@ -225,7 +225,7 @@ jobs:
           retention-days: 14
 
   release-tooling:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Release Tooling
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -249,7 +249,7 @@ jobs:
         run: npm run test:release
 
   workers-typecheck:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Workers Typecheck
     runs-on: ubuntu-latest
     timeout-minutes: 15
diff --git a/.github/workflows/contract.yml b/.github/workflows/contract.yml
index 31423a9f..d1438ea0 100644
--- a/.github/workflows/contract.yml
+++ b/.github/workflows/contract.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   contract:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/.github/workflows/relayfile-evals.yml b/.github/workflows/relayfile-evals.yml
index 649ee8be..72081f42 100644
--- a/.github/workflows/relayfile-evals.yml
+++ b/.github/workflows/relayfile-evals.yml
@@ -52,7 +52,7 @@ env:
 
 jobs:
   evals:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: Provider-backed evals
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml
index 2ddb4975..fbe379e4 100644
--- a/.github/workflows/trunk-guard.yml
+++ b/.github/workflows/trunk-guard.yml
@@ -1,17 +1,22 @@
 name: Trunk guard
 
-# Only the `trunk` branch may merge into main. Feature branches merge into
-# `trunk` (via the merge train); CI runs only on the trunk -> main PR.
+# Only this repository's `trunk` branch may merge into main. Feature branches
+# merge into `trunk`; CI runs only on the trunk -> main PR.
+# pull_request_target loads this workflow from the base branch, so a PR cannot
+# edit the guard to pass itself. It never checks out PR code.
 on:
-  pull_request:
+  pull_request_target:
     branches: [main]
+    types: [opened, synchronize, reopened, edited]
+
+permissions: {}
 
 jobs:
   only-trunk-merges-to-main:
-    if: github.head_ref != 'trunk'
+    if: github.head_ref != 'trunk' || github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 1
     steps:
       - run: |
-          echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'."
+          echo "::error::Only this repository's 'trunk' branch may merge into main. Retarget this PR to 'trunk'."
           exit 1