diff --git a/.github/workflows/docs-build-push.yml b/.github/workflows/docs-build-push.yml
index 9a0da81f..4411cfb6 100644
--- a/.github/workflows/docs-build-push.yml
+++ b/.github/workflows/docs-build-push.yml
@@ -47,7 +47,7 @@ jobs:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -70,7 +70,7 @@ jobs:
       ### Sphinx build
       - name: Setup Python
         if: inputs.doc_type == 'sphinx'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -125,13 +125,17 @@ jobs:
 
   pr-comment:
     needs: build
-    if: github.event.action == 'opened' || github.event.action == 'synchronize'
+    # Skip on PRs from forks: their GITHUB_TOKEN is read-only, so the
+    # createComment call below 403s ("Resource not accessible by integration").
+    if: >-
+      (github.event.action == 'opened' || github.event.action == 'synchronize')
+      && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-24.04
     permissions:
       pull-requests: write
     steps:
       - name: Post preview comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         env:
           PREVIEW_URL_PATH: ${{ inputs.preview_url_path }}
           PR_NUMBER: ${{ github.event.pull_request.number }}