diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
index cc032fc4..e5adc0f3 100644
--- a/.github/workflows/android-ci.yml
+++ b/.github/workflows/android-ci.yml
@@ -72,11 +72,6 @@ jobs:
     needs: [wrapper-validation, spotless]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v3
-        id: app-token
-        with:
-          client-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Checkout repository
         uses: actions/checkout@v7
       - name: Common setup
@@ -86,12 +81,24 @@ jobs:
           ./gradlew emojify:preTest
           ./gradlew emojify:test --stacktrace
           ./gradlew emojify:postTest
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        # Repository secrets are unavailable for pull_request events from forks,
+        # so the token step may fail there. continue-on-error keeps the job
+        # alive; tests must run regardless. When the app token is unavailable
+        # the report step falls back to the read-only GITHUB_TOKEN and uses
+        # annotate_only mode (no check-run creation, which needs checks: write).
+        continue-on-error: true
+        with:
+          client-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@v6
         if: always()
         with:
           report_paths: '**/build/test-results/**/TEST-*.xml'
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ steps.app-token.outputs.token || github.token }}
+          annotate_only: ${{ steps.app-token.outputs.token == '' }}
 
   publish-artifact:
     name: Publish Artifact