diff --git a/.github/workflows/test-warehouse.yml b/.github/workflows/test-warehouse.yml
index 891db7e09..675d65cc2 100644
--- a/.github/workflows/test-warehouse.yml
+++ b/.github/workflows/test-warehouse.yml
@@ -80,12 +80,23 @@ jobs:
           repository: elementary-data/elementary
           path: elementary
           ref: ${{ inputs.elementary-ref }}
+          persist-credentials: false
 
       - name: Checkout dbt package
         uses: actions/checkout@v6
         with:
           path: dbt-data-reliability
           ref: ${{ inputs.dbt-data-reliability-ref }}
+          # Don't leave the base repo's token in the git config: the checked out
+          # code is fork-controlled (see below) and nothing here pushes.
+          persist-credentials: false
+          # Fork PRs are tested via pull_request_target intentionally: the
+          # integration tests need the CI secrets of our test warehouses, which
+          # a pull_request run of a fork cannot access. The caller
+          # (test-all-warehouses.yml) gates fork PRs behind the
+          # elementary_test_env environment, so a maintainer must approve the
+          # run before this fork code is checked out and executed.
+          allow-unsafe-pr-checkout: true
 
       - name: Configure AWS credentials
         if: inputs.warehouse-type == 'athena'