diff --git a/.github/workflows/approve-flake-lock-prs.yml b/.github/workflows/approve-flake-lock-prs.yml
index 6b997c006..9f854d240 100644
--- a/.github/workflows/approve-flake-lock-prs.yml
+++ b/.github/workflows/approve-flake-lock-prs.yml
@@ -5,9 +5,9 @@ name: Approve flake.lock PRs (still require 1 human approval)
 permissions:
   pull-requests: write
 on:
-  pull_request_target:
-    paths:
-      - 'flake.lock' # only run if flake.lock has changed
+  pull_request:
+    paths: # only run if flake.lock has changed
+      - flake.lock
 jobs:
   approve-flake-lock-prs:
     runs-on: ubuntu-latest