diff --git a/.github/workflows/build-nightly.yml b/.github/workflows/build-nightly.yml
index 8e37d6b8ad..20760f0b68 100644
--- a/.github/workflows/build-nightly.yml
+++ b/.github/workflows/build-nightly.yml
@@ -12,6 +12,9 @@ jobs:
         with:
           access_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{github.event.pull_request.head.repo.full_name}}
       - uses: actions/setup-node@main
         with:
           node-version: 12.x
diff --git a/.github/workflows/bundle-app.yml b/.github/workflows/bundle-app.yml
index 0edbd839bf..a1965444d5 100644
--- a/.github/workflows/bundle-app.yml
+++ b/.github/workflows/bundle-app.yml
@@ -22,6 +22,9 @@ jobs:
           ban: ledgerlive
         if: github.event_name == 'pull_request'
       - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{github.event.pull_request.head.repo.full_name}}
       - uses: actions/setup-node@main
         with:
           node-version: 12.x
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c8937aad7..2123a980b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,6 @@
 name: CI
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - "*"
   push:
@@ -19,6 +19,7 @@ jobs:
       - uses: actions/checkout@v2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{github.event.pull_request.head.repo.full_name}}
       - uses: actions/setup-node@main
         with:
           node-version: 12.x
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1aa50e5746..1a4cac177e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -31,6 +31,9 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        repository: ${{github.event.pull_request.head.repo.full_name}}
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL