diff --git a/.github/workflows/rocshmem-ci.yml b/.github/workflows/rocshmem-ci.yml
index 607e48a..0b4074b 100644
--- a/.github/workflows/rocshmem-ci.yml
+++ b/.github/workflows/rocshmem-ci.yml
@@ -1,7 +1,7 @@
 name: rocSHMEM CI
 
 on:
-  pull_request:
+  pull_request_target:
     branches: [develop]
     types: [opened, synchronize, reopened, ready_for_review]
   schedule:
@@ -23,11 +23,14 @@ concurrency:
   group: rocshmem-hygon-github-nmz1-nmz2
   # A new PR commit supersedes the old validation run. Scheduled/manual full
   # runs remain serialized and are never cancelled by another invocation.
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request_target' }}
 
 jobs:
   build-and-test:
     name: Test (${{ github.event_name == 'schedule' && 'full' || 'standard' }})
+    if: >-
+      github.event_name != 'pull_request_target' ||
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
     runs-on: [self-hosted, Linux, X64, ci, nmz1, bw1100]
     timeout-minutes: 360
     env:
@@ -54,6 +57,10 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v4
         with:
+          ref: >-
+            ${{ github.event_name == 'pull_request_target' &&
+                format('refs/pull/{0}/merge', github.event.pull_request.number) ||
+                github.ref }}
           persist-credentials: false
           submodules: recursive