diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f619d3b30..737f400cf 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -72,6 +72,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index 210e69e83..221f4d806 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -24,6 +24,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
 
       - name: Lint OpenAPI Specification
         run: npx -y @redocly/cli lint --config doc/redocly.yaml doc/openapi/openapi.yaml
@@ -51,6 +52,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
 
       - name: Add Git safe Directory
         run: git config --global --add safe.directory '*'
@@ -76,6 +78,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
 
       - name: REUSE Compliance Check
         uses: fsfe/reuse-action@v6
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 647cad8a6..9f6af2402 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -12,7 +12,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -20,8 +20,11 @@ jobs:
     name: Setup Variables
     # Forks get a read-only GITHUB_TOKEN, so they run via pull_request_target.
     if: >-
-      github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.fork
-      || github.event_name != 'pull_request_target' && !github.event.pull_request.head.repo.fork
+      github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      || github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name == github.repository
+      || github.event_name == 'pull_request_target'
+      && github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
     environment: ${{ github.event_name == 'pull_request_target' && 'fork-pr' || 'internal' }}
     outputs:
@@ -139,7 +142,16 @@ jobs:
       is_version_tag: ${{ startsWith(github.ref, 'refs/tags/v') }}
 
   all:
-    name: All prerequisites completed
+    # Only the real run may claim the required check name. Mirrors setup.
+    name: >-
+      ${{ (github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      || github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name == github.repository
+      || github.event_name == 'pull_request_target'
+      && github.event.pull_request.head.repo.full_name != github.repository)
+      && 'All prerequisites completed' || 'CI not applicable' }}
+    # A skipped required check counts as passing.
+    if: always()
     needs:
       - setup
       - checks
@@ -155,7 +167,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dependency barrier
-        run: echo "All prerequisite jobs finished."
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1
 
   tag-minor-release:
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
diff --git a/.github/workflows/nix.yaml b/.github/workflows/nix.yaml
index 61b37e4a7..f8abe231a 100644
--- a/.github/workflows/nix.yaml
+++ b/.github/workflows/nix.yaml
@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
diff --git a/.github/workflows/packaging-docker.yaml b/.github/workflows/packaging-docker.yaml
index 47805a92f..50a7d4bb1 100644
--- a/.github/workflows/packaging-docker.yaml
+++ b/.github/workflows/packaging-docker.yaml
@@ -37,6 +37,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -68,7 +69,7 @@ jobs:
           cache-from: |
             type=gha,scope=dev-debian
             type=gha,scope=app-x86_64
-          cache-to: type=gha,mode=max,scope=app-x86_64
+          cache-to: ${{ github.event_name != 'pull_request_target' && 'type=gha,mode=max,scope=app-x86_64' || '' }}
           build-args: |
             ARCH=x86_64
             TRIPLET=x86_64-linux-gnu
@@ -83,6 +84,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -112,7 +114,7 @@ jobs:
           pull: true
           platforms: linux/arm64
           cache-from: type=gha,scope=app-arm64
-          cache-to: type=gha,mode=max,scope=app-arm64
+          cache-to: ${{ github.event_name != 'pull_request_target' && 'type=gha,mode=max,scope=app-arm64' || '' }}
           build-args: |
             ARCH=arm64
             TRIPLET=aarch64-linux-gnu
diff --git a/.github/workflows/packaging-nix.yaml b/.github/workflows/packaging-nix.yaml
index 16bb86515..abcf76c39 100644
--- a/.github/workflows/packaging-nix.yaml
+++ b/.github/workflows/packaging-nix.yaml
@@ -37,6 +37,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -77,6 +78,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -117,6 +119,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
diff --git a/.github/workflows/paper.yaml b/.github/workflows/paper.yaml
index f15dff461..89b34a6e3 100644
--- a/.github/workflows/paper.yaml
+++ b/.github/workflows/paper.yaml
@@ -19,6 +19,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
 
       - name: Build Draft PDF
         uses: openjournals/openjournals-draft-action@v1.0
diff --git a/.github/workflows/prepare.yaml b/.github/workflows/prepare.yaml
index 4c6263929..fba087952 100644
--- a/.github/workflows/prepare.yaml
+++ b/.github/workflows/prepare.yaml
@@ -60,6 +60,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -87,7 +88,7 @@ jobs:
           target: ${{ matrix.target || 'dev' }}
           push: true
           cache-from: type=gha,scope=dev-${{ matrix.image_name }}
-          cache-to: type=gha,mode=max,scope=dev-${{ matrix.image_name }}
+          cache-to: ${{ github.event_name != 'pull_request_target' && format('type=gha,mode=max,scope=dev-{0}', matrix.image_name) || '' }}
           tags: |
             ${{ env.DOCKER_IMAGE }}/dev-${{ matrix.image_name }}:${{ env.DOCKER_TAG }}
             ${{ env.DOCKER_IMAGE }}/dev-${{ matrix.image_name }}:${{ steps.ref.outputs.tag }}
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index dd3df427c..2243ad816 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -36,6 +36,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -70,6 +71,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -94,6 +96,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive
 
@@ -132,6 +135,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
           submodules: recursive