diff --git a/.github/workflows/pr-run.yaml b/.github/workflows/pr-run.yaml
index bdbf94a4..1edf4b34 100644
--- a/.github/workflows/pr-run.yaml
+++ b/.github/workflows/pr-run.yaml
@@ -1,7 +1,25 @@
 name: Validate & Deploy Plugins
 
 on:
+  # TEMPORARY, remove in a follow-up PR once this is merged: validate-and-deploy is a
+  # required status check, and a required check can never be satisfied by a PR that
+  # removes its own only trigger — pull_request_target (see below) always resolves from
+  # main, which doesn't have it yet, so it can't fire for *this* PR either. Keeping
+  # pull_request alive here just long enough for this PR to report its own required
+  # check; once merged, main has pull_request_target and every future PR is covered by
+  # it, so pull_request can come out again.
   pull_request:
+  # GitHub always resolves the workflow file (and GITHUB_REF/GITHUB_SHA) for
+  # pull_request_target from the repo's actual default branch, never the PR's own
+  # branch — so a PR editing this file (fork or not) can't change what runs against it.
+  pull_request_target:
+
+# Serialize runs per PR so an older run (from a rapid follow-up push, or the transitional
+# pull_request/pull_request_target overlap above) can't finish last and overwrite a newer
+# deploy that reuses the same --suffix.
+concurrency:
+  group: pr-run-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   validate-and-deploy:
@@ -11,6 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Detect modified plugins
@@ -37,14 +56,18 @@ jobs:
         env:
           SQUAREDUP_API_KEY: ${{ secrets.SQUAREDUP_API_KEY }}
         run: |
-            echo "Installing SquaredUp CLI..."
-            npm install -g @squaredup/cli
-            echo "Configuring SquaredUp CLI with API key..."
-            squaredup login --apiKey "$SQUAREDUP_API_KEY"
+          echo "Installing SquaredUp CLI..."
+          cd "$RUNNER_TEMP"
+          npm install -g @squaredup/cli
+          echo "SquaredUp CLI version: $(squaredup -v)"
+          echo "Configuring SquaredUp CLI with API key..."
+          squaredup login --apiKey "$SQUAREDUP_API_KEY"
 
       - name: Validate modified plugins
         id: validate
         if: steps.detect.outputs.plugins_modified == 'true'
+        env:
+          PLUGIN_PATHS: ${{ steps.detect.outputs.plugin_paths }}
         run: |
           validation_failed=false
 
@@ -66,7 +89,7 @@ jobs:
               validation_failed=true
             fi
             echo ""
-          done <<< "${{ steps.detect.outputs.plugin_paths }}"
+          done <<< "$PLUGIN_PATHS"
 
           if [ "$validation_failed" = "true" ]; then
             echo "One or more plugins failed validation."
@@ -75,17 +98,26 @@ jobs:
 
       - name: Deploy modified plugins
         id: deploy
-        if: steps.detect.outputs.plugins_modified == 'true'
+        # Fork PRs only validate; deploying arbitrary fork-submitted plugin code (incl.
+        # scripts) to the live tenant needs a maintainer to merge/trigger it deliberately.
+        # Restricted to pull_request_target specifically while both triggers coexist
+        # (see TEMPORARY note above) — otherwise a same-repo PR would deploy twice per
+        # push, racing on the same --suffix.
+        if: steps.detect.outputs.plugins_modified == 'true' && github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request_target'
+        env:
+          PLUGIN_PATHS: ${{ steps.detect.outputs.plugin_paths }}
         run: |
           while IFS= read -r plugin_path; do
             echo "Deploying ${plugin_path}..."
             squaredup deploy "${plugin_path}" --suffix "${{ github.event.pull_request.number }}" --force
             echo "Deployed ${plugin_path} successfully."
             echo ""
-          done <<< "${{ steps.detect.outputs.plugin_paths }}"
+          done <<< "$PLUGIN_PATHS"
 
       - name: Summary
         if: always()
+        env:
+          PLUGIN_PATHS: ${{ steps.detect.outputs.plugin_paths }}
         run: |
           OUT=/tmp/summary.md
 
@@ -101,7 +133,7 @@ jobs:
           echo "### 📦 Modified Plugins" >> $OUT
           while IFS= read -r plugin_path; do
             echo "- \`${plugin_path}\`" >> $OUT
-          done <<< "${{ steps.detect.outputs.plugin_paths }}"
+          done <<< "$PLUGIN_PATHS"
           echo "" >> $OUT
 
           echo "### 📋 Results" >> $OUT