diff --git a/.github/workflows/automerge-dependabot.yml b/.github/workflows/automerge-dependabot.yml
index cd5c91bcf..94aa5a073 100644
--- a/.github/workflows/automerge-dependabot.yml
+++ b/.github/workflows/automerge-dependabot.yml
@@ -6,8 +6,10 @@ name: Auto-Merge Dependabot PRs
 
 on:
   # Trigger when a PR is opened or updated
-  # WARNING: This needs to be run in the PR base, DO NOT build untrusted code in this action
-  pull_request_target:
+  # Normally pull_request gets a GITHUB_TOKEN with read access only.
+  # But workflows run for PRs created by dependabot get write access anyway,
+  # so the less secure 'pull_request_target' trigger is not required.
+  pull_request:
     types: [opened, synchronize, reopened]
 
 jobs: