diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 5c6b0b8da4c6..b7f875cce01b 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -45,7 +45,6 @@ jobs:
   check:
     name: Check
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -68,7 +67,7 @@ jobs:
         run: nix-build trusted/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_RO_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -91,7 +90,6 @@ jobs:
   request:
     name: Request
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
@@ -101,8 +99,11 @@ jobs:
         with:
           path: trusted
 
+      - name: Build review request package
+        run: nix-build trusted/ci -A requestReviews
+
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,9 +112,6 @@ jobs:
           permission-members: read
           permission-pull-requests: write
 
-      - name: Build review request package
-        run: nix-build trusted/ci -A requestReviews
-
       - name: Request reviews
         if: steps.app-token.outputs.token
         env:
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 40a60bbfe025..473f974a024b 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     paths:
       - .github/workflows/eval.yml
-      - .github/workflows/reviews.yml # needs eval results from the same event type
+      - .github/workflows/reviewers.yml # needs eval results from the same event type
   pull_request_target:
   push:
     # Keep this synced with ci/request-reviews/dev-branches.txt
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 884cd2b266a6..a859ac70acb1 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -44,7 +44,7 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}