diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 58e9a87e..0597a299 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -7,12 +7,11 @@ on:
 
 jobs:
   claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-    
+    # Fork PRs get a read-only GITHUB_TOKEN and no secrets, so the action fails
+    # with 403 when posting its comment. Skip them; maintainers can still
+    # request a review with an @claude comment.
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
+
     runs-on: ubuntu-latest
     permissions:
       contents: read