diff --git a/.github/workflows/reusable_claude_pr_review.yml b/.github/workflows/reusable_claude_pr_review.yml
index b2935b7..daf027e 100644
--- a/.github/workflows/reusable_claude_pr_review.yml
+++ b/.github/workflows/reusable_claude_pr_review.yml
@@ -242,6 +242,9 @@ jobs:
           persist-credentials: false
           submodules: false
           fetch-depth: 0
+          # checkout v7 refuses fork code under workflow_run without this opt-in.
+          # Safe here: the code is only read, never run, and no token persists.
+          allow-unsafe-pr-checkout: true
 
       # Remove any symlinks from the checkout so the agent's read tools can only
       # see files inside pr-head/.