diff --git a/.github/workflows/Deploy-internal.yml b/.github/workflows/Deploy-internal.yml
index 4f6261e..68de9b0 100644
--- a/.github/workflows/Deploy-internal.yml
+++ b/.github/workflows/Deploy-internal.yml
@@ -1,33 +1,49 @@
 name: Deploy internal
+
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
     paths:
       - "**/*.jmd"
       - "**/Project.toml"
 
+permissions:
+  contents: write
+
 jobs:
   generate-job-strategy-matrix:
     runs-on: ubuntu-latest
     outputs:
       job-strategy-matrix: ${{ steps.generate.outputs.job-strategy-matrix }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Checkout PR code
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 5
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 2
+          persist-credentials: false
+
       - name: Generate MATRIX
         id: generate
         run: |
           MATRIX=$( (
             echo '{ "tutorial": ['
-            git diff --name-only HEAD HEAD~1 | grep -E "(jmd|Project.toml)" | sed 's/Project.toml/index.jmd/g' | uniq | sed -r 's/(.*)/\"\1\"/g' | sed '$!s/$/,/'
+            git diff --name-only HEAD HEAD~1 \
+              | grep -E "(jmd|Project.toml)" \
+              | sed 's/Project.toml/index.jmd/g' \
+              | uniq \
+              | sed -r 's/(.*)/\"\1\"/g' \
+              | sed '$!s/$/,/'
             echo ']}'
           ) | jq -c .)
-          echo $MATRIX
-          echo $MATRIX | jq .
-          echo "::set-output name=job-strategy-matrix::$MATRIX"
+
+          echo "$MATRIX"
+          echo "$MATRIX" | jq .
+
+          # new-style output
+          echo "job-strategy-matrix=$MATRIX" >> "$GITHUB_OUTPUT"
 
   build-tutorials:
     needs: generate-job-strategy-matrix
@@ -36,20 +52,27 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.generate-job-strategy-matrix.outputs.job-strategy-matrix) }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Checkout PR code
+        uses: actions/checkout@v4
         with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
           persist-credentials: false
+
       - name: Install Julia
         uses: julia-actions/setup-julia@v1
         with:
           version: 1
+
       - name: Build tutorial
         run: |
           bash .github/workflows/build_tutorial.sh ${{ matrix.tutorial }}
+
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
+          name: tutorials
           path: markdown/*
 
   deploy:
@@ -61,38 +84,55 @@ jobs:
         run: |
           wget https://github.com/JuliaSmoothOptimizers/JSOTutorials.jl/archive/refs/heads/gh-pages.zip
           unzip gh-pages.zip
+
       - name: Download artifact
         uses: actions/download-artifact@v4
         with:
+          name: tutorials
           path: .
-      - name: list
+
+      - name: List files
         run: ls -R
+
       - name: Merge gh-pages and updates and update index.md
         run: |
-          cp -rf artifact/* JSOTutorials.jl-gh-pages/
+          cp -rf markdown/* JSOTutorials.jl-gh-pages/
           cd JSOTutorials.jl-gh-pages
+
           echo "## JSOTutorials preview page
 
           For the complete list of tutorials, go to <https://jso.dev/tutorials/>.
 
           " > index.md
-          for file in **/*.md; do NAME=$(echo $file | cut -d/ -f 1); TITLE=$(grep "title:" $file | cut -d\" -f2); echo "- [$TITLE]($NAME/)"; done >> index.md
+
+          for file in **/*.md; do
+            NAME=$(echo "$file" | cut -d/ -f 1)
+            TITLE=$(grep "title:" "$file" | cut -d\" -f2)
+            echo "- [$TITLE]($NAME/)"
+          done >> index.md
+
       - name: Deploy to gh-pages
         uses: peaceiris/actions-gh-pages@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./JSOTutorials.jl-gh-pages
           enable_jekyll: true
+
   pr_comment:
     needs: [generate-job-strategy-matrix, build-tutorials, deploy]
     runs-on: ubuntu-latest
     if: ${{ needs.generate-job-strategy-matrix.outputs.job-strategy-matrix != '[]' }}
     steps:
-      - name: "Comment PR"
+      - name: Comment PR
         uses: actions/github-script@0.3.0
-        if: github.event_name == 'pull_request' && github.repository == github.event.pull_request.head.repo.full_name # if this is a pull request build AND the pull request is NOT made from a fork
+        if: github.event_name == 'pull_request_target'
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const { issue: { number: issue_number }, repo: { owner, repo }  } = context;
-            github.issues.createComment({ issue_number, owner, repo, body: 'Once the build has completed, you can preview your PR at this URL: https://jso.dev/JSOTutorials.jl/' });
+            const { issue: { number: issue_number }, repo: { owner, repo } } = context;
+            github.issues.createComment({
+              issue_number,
+              owner,
+              repo,
+              body: 'Once the build has completed, you can preview your PR at this URL: https://jso.dev/JSOTutorials.jl/'
+            });