diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c570becb3..43ef28b32 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -337,6 +337,8 @@ jobs:
     name: devolutions-gateway-web-ui
     runs-on: ubuntu-latest
     needs: preflight
+
+    # DEVOLUTIONSBOT_TOKEN is a repository secret, and it can’t be used by PRs originating from forks.
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
@@ -1077,6 +1079,7 @@ jobs:
     name: OneDrive
     runs-on: ubuntu-latest
     if: ${{ github.ref == 'refs/heads/master' }}
+    environment: onedrive-upload # for OneDrive secrets
     needs:
       - preflight # required for needs.preflight.outputs
       - upload-git-log