diff --git a/.github/workflows/claude-code-reusable.yml b/.github/workflows/claude-code-reusable.yml
index 4d1fc9ff8..4cf481efe 100644
--- a/.github/workflows/claude-code-reusable.yml
+++ b/.github/workflows/claude-code-reusable.yml
@@ -26,7 +26,8 @@ jobs:
       (github.event_name == 'pull_request_review_comment' &&
         github.event.comment.user.login != 'claude[bot]' &&
         (contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) ||
-          contains(fromJson('["coderabbitai[bot]","Copilot"]'), github.event.comment.user.login)))
+          (github.event.pull_request.head.repo.full_name == github.repository &&
+            contains(fromJson('["coderabbitai[bot]","Copilot","copilot-pull-request-reviewer[bot]","gemini-code-assist[bot]"]'), github.event.comment.user.login))))
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
@@ -55,7 +56,7 @@ jobs:
     if: >-
       github.event_name == 'check_run' &&
       github.event.check_run.conclusion == 'failure' &&
-      !startsWith(github.event.check_run.name, 'Claude Code')
+      !startsWith(github.event.check_run.name, 'claude-code / ')
     concurrency:
       group: claude-ci-fix-${{ github.event.check_run.head_sha }}
       cancel-in-progress: true
@@ -80,6 +81,15 @@ jobs:
               "repos/${{ github.repository }}/commits/${{ github.event.check_run.head_sha }}/pulls" \
               --jq '[.[] | select(.state == "open")] | first | .number // empty')
           fi
+          # Trust gate: skip fork PRs — this job has write/secret access
+          if [ -n "$PR" ]; then
+            HEAD_REPO=$(gh api "repos/${{ github.repository }}/pulls/$PR" \
+              --jq '.head.repo.full_name // empty')
+            if [ "$HEAD_REPO" != "${{ github.repository }}" ]; then
+              echo "Skipping: fork PR (head=$HEAD_REPO)"
+              PR=""
+            fi
+          fi
           echo "number=$PR" >> "$GITHUB_OUTPUT"
       - name: Checkout repository
         if: steps.pr.outputs.number != ''