diff --git a/.github/workflows/cloud-tests.yml b/.github/workflows/cloud-tests.yml
index d6710ddb..b3185741 100644
--- a/.github/workflows/cloud-tests.yml
+++ b/.github/workflows/cloud-tests.yml
@@ -24,6 +24,9 @@ permissions:
 jobs:
   example-tests:
     name: example-tests (${{ matrix.python-version }})
+    # 1. Run for non-PR events, such as scheduled runs and manual invocations
+    # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
+    if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/conformance-tests.yml b/.github/workflows/conformance-tests.yml
index b3ab24ae..d1a1483e 100644
--- a/.github/workflows/conformance-tests.yml
+++ b/.github/workflows/conformance-tests.yml
@@ -39,6 +39,9 @@ permissions:
 jobs:
   discover_suites:
     name: discover conformance suites
+    # 1. Run for non-PR events, such as scheduled runs and manual invocations
+    # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
+    if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     outputs:
       suites: ${{ steps.discover.outputs.suites }}
diff --git a/.github/workflows/opentelemetry-conformance-tests.yml b/.github/workflows/opentelemetry-conformance-tests.yml
index 22cda0c7..35057712 100644
--- a/.github/workflows/opentelemetry-conformance-tests.yml
+++ b/.github/workflows/opentelemetry-conformance-tests.yml
@@ -52,6 +52,9 @@ permissions: {}
 
 jobs:
   opentelemetry:
+    # 1. Run for non-PR events, such as scheduled runs and manual invocations
+    # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
+    if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
     permissions:
       actions: write
       contents: read