diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b5b722..f3ea41c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -207,7 +207,8 @@ jobs:
         key: ${{ steps.resource-cache.outputs.cache-primary-key }}
 
     - name: Upload SARIF to Code Scanning
-      if: runner.os == 'Linux' && always() && hashFiles('artifacts/self-analysis.sarif') != ''
+      # A pull request from a fork gets a read-only token, which Code Scanning refuses.
+      if: runner.os == 'Linux' && always() && hashFiles('artifacts/self-analysis.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
       uses: github/codeql-action/upload-sarif@v3
       with:
         sarif_file: artifacts/self-analysis.sarif
diff --git a/.github/workflows/concurrency.yml b/.github/workflows/concurrency.yml
index 0405318..101779a 100644
--- a/.github/workflows/concurrency.yml
+++ b/.github/workflows/concurrency.yml
@@ -60,3 +60,5 @@ jobs:
         with:
           compile-commands: build/compile_commands.json
           fail-on: error
+          # A pull request from a fork gets a read-only token, which Code Scanning refuses.
+          upload-sarif: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}