diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 568078fd..9082f640 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -121,8 +121,11 @@ jobs:
         if-no-files-found: warn
 
     - name: SonarCloud Analysis
-      # Skip when SONAR_TOKEN is unavailable (fork/Dependabot PRs).
-      if: env.SONAR_TOKEN != ''
+      # Skip when SONAR_TOKEN is unavailable (fork PRs) and for any bot-authored
+      # PR (Dependabot, Renovate, ...). The bot check uses the PR author's
+      # account type rather than a hard-coded login, and is not defeated by a
+      # maintainer re-run (which would otherwise make the withheld token appear).
+      if: env.SONAR_TOKEN != '' && github.event.pull_request.user.type != 'Bot'
       run: mvn -B org.sonarsource.scanner.maven:sonar-maven-plugin:sonar --file pom.xml
 
     - name: Upload JaCoCo HTML report (processor)
@@ -174,8 +177,8 @@ jobs:
         if-no-files-found: warn
 
     - name: Upload test results to Codecov (processor)
-      # Skip when CODECOV_TOKEN is unavailable (fork/Dependabot PRs).
-      if: always() && env.CODECOV_TOKEN != ''
+      # Skip when CODECOV_TOKEN is unavailable (fork PRs) and for any bot-authored PR.
+      if: always() && env.CODECOV_TOKEN != '' && github.event.pull_request.user.type != 'Bot'
       uses: codecov/test-results-action@47f89e9acb64b76debcd5ea40642d25a4adced9f # v1.1.1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
@@ -186,8 +189,8 @@ jobs:
         verbose: false
 
     - name: Upload coverage to Codecov (processor)
-      # Skip when CODECOV_TOKEN is unavailable (fork/Dependabot PRs).
-      if: always() && env.CODECOV_TOKEN != ''
+      # Skip when CODECOV_TOKEN is unavailable (fork PRs) and for any bot-authored PR.
+      if: always() && env.CODECOV_TOKEN != '' && github.event.pull_request.user.type != 'Bot'
       uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7
       with:
         fail_ci_if_error: true