diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index 758bd66..f3fab25 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -18,8 +18,14 @@ permissions:
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
+    # A dependency PR is recognised by its branch as well as its author: with BOT_PAT the
+    # author is the PAT's owner (user.type 'User'), so user.type alone never matched
+    # CompatHelper's PRs. head.repo pins the branch to this repository, not a fork.
     if: >
       github.event.pull_request.user.type == 'Bot' ||
+      (github.event.pull_request.head.repo.full_name == github.repository &&
+       (startsWith(github.event.pull_request.head.ref, 'compathelper/') ||
+        startsWith(github.event.pull_request.head.ref, 'dependabot/'))) ||
       contains(github.event.pull_request.labels.*.name, 'automerge')
     steps:
       - name: Enable auto-merge (squash, delete branch)
diff --git a/.github/workflows/compathelper.yml b/.github/workflows/compathelper.yml
index 5617830..0a6fd9c 100644
--- a/.github/workflows/compathelper.yml
+++ b/.github/workflows/compathelper.yml
@@ -31,5 +31,14 @@ jobs:
       - name: CompatHelper.main()
         env:
           GITHUB_TOKEN: ${{ secrets.BOT_PAT || secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_PAT || secrets.GITHUB_TOKEN }}
           COMPATHELPER_PRIV: ${{ secrets.COMPATHELPER_PRIV }}
-        run: julia -e 'using CompatHelper; CompatHelper.main()'
+        # CompatHelper skips a bump when an open PR already has its title, but it only
+        # counts PRs by `username` (default github-actions[bot]). With BOT_PAT the PRs are
+        # the PAT owner's, so none counted and every run opened the same PR again. Pass the
+        # token's own login; GITHUB_TOKEN cannot call /user and keeps the default.
+        run: |
+          LOGIN=$(gh api user --jq .login 2>/dev/null) || LOGIN='github-actions[bot]'
+          echo "CompatHelper PR author: $LOGIN"
+          julia -e 'using CompatHelper
+                    CompatHelper.main(ENV, CompatHelper.GitHubActions(; username = ARGS[1]))' "$LOGIN"
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index e4a77ab..a575ab3 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -33,13 +33,24 @@ jobs:
         env:
           BASE: ${{ steps.base.outputs.version }}
           PR:   ${{ steps.pr.outputs.version }}
+          USER_TYPE: ${{ github.event.pull_request.user.type }}
+          HEAD_REF:  ${{ github.head_ref }}
+          SAME_REPO: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
-          # Bot-authored PRs (CompatHelper / dependabot) bump [compat]/deps, not
+          # Dependency PRs (CompatHelper / dependabot) bump [compat]/deps, not
           # the package version — exempt them so the required check still runs
-          # (and passes) instead of blocking auto-merge.
-          if [ "${{ github.event.pull_request.user.type }}" = "Bot" ]; then
+          # (and passes) instead of blocking auto-merge. They are recognised by
+          # branch as well as author: CompatHelper runs with BOT_PAT, so its PRs
+          # are authored by a User and the author check alone never matched.
+          if [ "$USER_TYPE" = "Bot" ]; then
             echo "✓ bot-authored PR — version bump not required"; exit 0
           fi
+          case "$HEAD_REF" in
+            compathelper/*|dependabot/*)
+              if [ "$SAME_REPO" = "true" ]; then
+                echo "✓ dependency PR ($HEAD_REF) — version bump not required"; exit 0
+              fi ;;
+          esac
           IFS='.' read -r bM bm bp <<< "$BASE"
           IFS='.' read -r pM pm pp <<< "$PR"
           bM=${bM:-0}; bm=${bm:-0}; bp=${bp:-0}