diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 6744d92..1f68594 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,21 +4,36 @@ on:
   pull_request:
     branches:
       - main
-  push:
+  # Use the base repository's permissions for merged PRs, including forks.
+  pull_request_target:
+    types: [closed]
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   build:
+    # Never build an unmerged PR in the privileged pull_request_target context.
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'pull_request_target' &&
+       github.event.action == 'closed' &&
+       github.event.pull_request.merged == true &&
+       github.event.pull_request.base.ref == 'main')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
         with:
+          # On merge, build the accepted commit rather than the PR head.
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.merge_commit_sha || github.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: prefix-dev/setup-pixi@v0.9.2
         with:
@@ -37,6 +52,13 @@ jobs:
     # Add a dependency to the build job
     needs: build
 
+    # Deploy only after a PR has been merged into main.
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == 'main'
+
     # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
     permissions:
       pages: write      # to deploy to Pages
@@ -50,9 +72,6 @@ jobs:
     # Specify runner + deployment step
     runs-on: ubuntu-latest
 
-    # Shouldn't run when the PR comes from a fork
-    if: ${{ !github.event.pull_request.head.repo.fork }}
-
     steps:
       - name: Deploy to GitHub Pages
         id: deployment