diff --git a/.github/WORKFLOW_README.md b/.github/WORKFLOW_README.md
index 30a74a0..bb1b533 100644
--- a/.github/WORKFLOW_README.md
+++ b/.github/WORKFLOW_README.md
@@ -15,6 +15,8 @@ This repository is configured with automated dependency updates and release buil
 ### 2. Dependabot Auto-merge (`.github/workflows/dependabot-automerge.yml`)
 
 - **Off unless the repo Variable `DEPENDABOT_AUTOMERGE` is `true`.**
+- Runs on `pull_request` (GitHub's documented Dependabot pattern), not `pull_request_target`, which
+  GitHub is blocking by default on public repos.
 - When on, enables GitHub auto-merge (squash) for patch and minor Dependabot updates; major updates
   wait for manual review.
 - Auto-merge waits only for checks that branch protection marks **required**. With no required
@@ -24,7 +26,8 @@ This repository is configured with automated dependency updates and release buil
 **Optional Setup**: If your repository has branch protection requiring PR approval:
 
 1. Create a Personal Access Token (PAT) with `repo` scope
-2. Add it as a repository secret named `DEPENDABOT_PAT`
+2. Add it as a **Dependabot** secret named `DEPENDABOT_PAT` (Settings → Secrets and variables →
+   Dependabot); runs triggered by Dependabot cannot read ordinary Actions secrets
 3. Uncomment the auto-approve step in the workflow
 
 ### 3. CI (`.github/workflows/ci.yml`)
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 743e7fe..06c7727 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,6 +1,13 @@
 name: Dependabot Auto-merge
+# `pull_request`, not `pull_request_target`: this is GitHub's documented
+# Dependabot auto-merge pattern, and GitHub is making pull_request_target
+# blocked by default on public repos (a scheduled brownout already stopped this
+# workflow from starting on 2026-11-09). A Dependabot-triggered run gets a
+# read-only GITHUB_TOKEN that the `permissions` block below raises, and only
+# Dependabot secrets; the job needs neither a secret nor the base-branch
+# context that pull_request_target existed for.
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
@@ -19,9 +26,14 @@ jobs:
     # when main has no rule requiring the CI checks, GitHub auto-merge has
     # nothing to wait for and merges the moment it is enabled (PRs #5, #6
     # and #8 merged ~12 s after opening, before CI started). Turn it on only
-    # after main requires the CI checks to pass.
+    # after main requires the CI checks to pass. If the variable ever does not
+    # reach a Dependabot-triggered run, the condition is false and the job
+    # skips, so the failure mode is "auto-merge off", never "merge unchecked".
+    #
+    # The repository check keeps forks of this repo from running the job.
     if: >-
       vars.DEPENDABOT_AUTOMERGE == 'true' &&
+      github.repository == 'iLevyTate/StratoSortStack' &&
       github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps: