diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 261c4d5..e3d5f32 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -1,7 +1,10 @@
 name: Claude Code Review
 
 on:
-  pull_request:
+  # Using pull_request_target to run with base repo permissions (access to secrets)
+  # This allows the workflow to run for fork PRs after maintainer approval
+  # Security: This workflow only READS PR code for review, it does NOT execute it
+  pull_request_target:
     types: [opened, synchronize]
     # Skip review for documentation and config-only changes
     paths-ignore:
@@ -32,13 +35,15 @@ jobs:
           deletions=${{ github.event.pull_request.deletions }}
           total=$((additions + deletions))
           echo "total=$total" >> $GITHUB_OUTPUT
-      - name: Checkout repository
+      - name: Checkout PR code for review
         # Only review substantial changes (5+ files OR 20+ lines changed)
         if: |
           github.event.pull_request.changed_files >= 5 ||
           steps.calc.outputs.total >= 20
         uses: actions/checkout@v4
         with:
+          # Checkout the PR head commit (pull_request_target defaults to base branch)
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
 
       - name: Run Claude Code Review
diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index e8dea3b..dc09a94 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -1,7 +1,10 @@
 name: OpenCode PR Review
 
 on:
-  pull_request:
+  # Using pull_request_target to run with base repo permissions (access to secrets)
+  # This allows the workflow to run for fork PRs after maintainer approval
+  # Security: This workflow only READS PR code for review, it does NOT execute it
+  pull_request_target:
     types: [opened, synchronize]
     # Skip review for documentation and config-only changes
     # Exclude this workflow file to prevent self-triggering loops
@@ -35,13 +38,15 @@ jobs:
           total=$((additions + deletions))
           echo "total=$total" >> $GITHUB_OUTPUT
 
-      - name: Checkout repository
+      - name: Checkout PR code for review
         # Only review substantial changes (5+ files OR 20+ lines changed)
         if: |
           github.event.pull_request.changed_files >= 5 ||
           steps.calc.outputs.total >= 20
         uses: actions/checkout@v6
         with:
+          # Checkout the PR head commit (pull_request_target defaults to base branch)
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
           persist-credentials: false