diff --git a/.github/workflows/github_actions.yml b/.github/workflows/github_actions.yml
index e95f960c0..6fd5bf34c 100644
--- a/.github/workflows/github_actions.yml
+++ b/.github/workflows/github_actions.yml
@@ -13,8 +13,12 @@ jobs:
       group: browserstack-${{ github.event.pull_request.number }}
       cancel-in-progress: true
     # Auto-run for Dependabot; let humans opt in via the safe_to_test label.
+    # Require the triggering actor to also be Dependabot so commits pushed by
+    # anyone else fall back to the explicit safe_to_test opt-in.
     if: >-
-      (github.event.pull_request.user.login == 'dependabot[bot]' && github.event.action != 'labeled') ||
+      (github.event.pull_request.user.login == 'dependabot[bot]' &&
+       github.actor == 'dependabot[bot]' &&
+       github.event.action != 'labeled') ||
       github.event.label.name == 'safe_to_test'
     env:
       GITACTIONS: true