diff --git a/.github/workflows/welcome-first-time-contrib.yml b/.github/workflows/welcome-first-time-contrib.yml
index 57c5f00e..a98263a7 100644
--- a/.github/workflows/welcome-first-time-contrib.yml
+++ b/.github/workflows/welcome-first-time-contrib.yml
@@ -4,9 +4,9 @@
 name: Welcome first time contributors
 
 on:
-  pull_request:
-    types: 
-      - opened
+  pull_request_target:      # Needed to write welcome comments on fork PRs; script only uses the GitHub API.
+    types:
+      - opened              # zizmor: ignore[dangerous-triggers]
   issues:
     types:
       - opened