diff --git a/.github/workflows/preview-deploy.yml b/.github/workflows/preview-deploy.yml
index 7a9c6e27c9..0e241365c0 100644
--- a/.github/workflows/preview-deploy.yml
+++ b/.github/workflows/preview-deploy.yml
@@ -5,12 +5,18 @@ on:
     types:
       - completed
 
+# pull_request_target needs explicit perms; fork PRs default to read-only.
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   deploy:
     runs-on: "ubuntu-22.04"
     if: >
       github.repository_owner == 'php' &&
-      github.event.workflow_run.event == 'pull_request'
+      github.event.workflow_run.event == 'pull_request_target'
 
     steps:
       - name: Download PR number