diff --git a/.github/workflows/integration-drizzle.yml b/.github/workflows/integration-drizzle.yml
index 3db687917..a37605f80 100644
--- a/.github/workflows/integration-drizzle.yml
+++ b/.github/workflows/integration-drizzle.yml
@@ -76,7 +76,12 @@ jobs:
       cancel-in-progress: false
     # Fork PRs have no secrets. Skip cleanly rather than fail on something the
     # contributor cannot fix — `tests.yml` still gives them a green signal.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs are skipped for the same reason: they run under the
+    # Dependabot secret store, which does not carry the identity suites'
+    # CLERK_MACHINE_TOKEN, so the lock-context suite would fail-loud (by design
+    # it throws rather than skips) on a change Dependabot cannot fix. A
+    # dependency bump's real signal is `tests.yml` + the lockfile checks.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/integration-prisma-next.yml b/.github/workflows/integration-prisma-next.yml
index 55eb9585b..bc75206c6 100644
--- a/.github/workflows/integration-prisma-next.yml
+++ b/.github/workflows/integration-prisma-next.yml
@@ -65,7 +65,11 @@ jobs:
       cancel-in-progress: false
     # Fork PRs have no secrets. Skip cleanly rather than fail on something the
     # contributor cannot fix — `tests.yml` still gives them a green signal.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs skip for the same reason: they run under the Dependabot
+    # secret store (a distinct, narrower set), so a secret-consuming live suite
+    # can fail on a change Dependabot cannot fix. A dependency bump's real
+    # signal is `tests.yml` + the lockfile checks.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/integration-supabase.yml b/.github/workflows/integration-supabase.yml
index 64252ff59..d5a56aa5e 100644
--- a/.github/workflows/integration-supabase.yml
+++ b/.github/workflows/integration-supabase.yml
@@ -64,7 +64,11 @@ jobs:
       cancel-in-progress: false
     # Fork PRs have no secrets. Skip cleanly rather than fail loudly on something
     # the contributor cannot fix — `tests.yml` still gives them a green signal.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs skip for the same reason: they run under the Dependabot
+    # secret store (a distinct, narrower set), so a secret-consuming live suite
+    # can fail on a change Dependabot cannot fix. A dependency bump's real
+    # signal is `tests.yml` + the lockfile checks.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     strategy:
       # A one-element matrix, not a cross-product: the Supabase adapter only ever
diff --git a/.github/workflows/prisma-example-readme-e2e.yml b/.github/workflows/prisma-example-readme-e2e.yml
index 15652254d..8f0de37d7 100644
--- a/.github/workflows/prisma-example-readme-e2e.yml
+++ b/.github/workflows/prisma-example-readme-e2e.yml
@@ -33,7 +33,10 @@ jobs:
     # Skip cleanly on fork PRs where secrets aren't available. The
     # test's `describe.skipIf(!authConfigured)` would also skip, but
     # gating at the job level produces a clean "skipped" status.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs skip too — they run under the Dependabot secret store, so a
+    # secret-consuming live suite can fail on a change Dependabot cannot fix;
+    # `tests.yml` + lockfile checks are the real signal for a dependency bump.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     env:
       CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
diff --git a/.github/workflows/prisma-next-e2e.yml b/.github/workflows/prisma-next-e2e.yml
index 8c2e260ae..073bc4987 100644
--- a/.github/workflows/prisma-next-e2e.yml
+++ b/.github/workflows/prisma-next-e2e.yml
@@ -34,8 +34,11 @@ jobs:
     # Skip cleanly on fork PRs where secrets aren't available. The
     # global-setup hook in the suite hard-errors when `CS_WORKSPACE_CRN`
     # is unset; gating at the job level produces a clean "skipped"
-    # status instead of a noisy failure.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # status instead of a noisy failure. Dependabot PRs skip too — they run
+    # under the Dependabot secret store, so a secret-consuming live suite can
+    # fail on a change Dependabot cannot fix; `tests.yml` + lockfile checks are
+    # the real signal for a dependency bump.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     env:
       CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}