diff --git a/.github/actions/run/action.yml b/.github/actions/run/action.yml
index 0b0afa0..14f5d93 100644
--- a/.github/actions/run/action.yml
+++ b/.github/actions/run/action.yml
@@ -139,7 +139,8 @@ runs:
         if-no-files-found: ${{ inputs.shard != '' && 'error' || 'warn' }}
 
     - name: Post contract report to PR
-      if: inputs.contract-report == 'true' && github.event_name == 'pull_request'
+      # A fork PR gets a read-only token, so commenting would fail the job.
+      if: inputs.contract-report == 'true' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
       shell: bash
       working-directory: ${{ inputs.working-directory }}
       env:
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 5fce777..d0f34af 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -90,7 +90,8 @@ jobs:
           cat .twd/contract-report.md
 
       - name: Post contract report to PR
-        if: github.event_name == 'pull_request'
+        # A fork PR gets a read-only token, so commenting would fail the job.
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         working-directory: test-example-app
         env:
           GH_TOKEN: ${{ github.token }}