diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 6585d24..ee4ec74 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -6,11 +6,13 @@ name: Claude Code Review
 # `pull_request` version never worked for fork PRs.
 #
 # SECURITY: pull_request_target runs in the BASE repo with secrets and a
-# write-capable token. The job is gated to PRs from the trusted `jnasbyupgrade`
-# fork only — an arbitrary external fork can never trigger this secret-bearing
-# job. The workflow file always comes from the base branch (master), so a PR
-# cannot modify the reviewer that runs on it. We check out the PR head only for
-# read context (persist-credentials: false) and never build or execute PR code.
+# write-capable token. The job is gated to PRs authored by jnasbyupgrade only
+# — github.event.pull_request.user.login is the PR's original author and
+# can't be spoofed by PR content, so this check holds regardless of whether
+# the PR head lives in this repo or an external fork. The workflow file
+# always comes from the base branch (master), so a PR cannot modify the
+# reviewer that runs on it. We check out the PR head only for read context
+# (persist-credentials: false) and never build or execute PR code.
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review]
@@ -21,11 +23,11 @@ concurrency:
 
 jobs:
   claude-review:
-    # Trusted fork only, and skip drafts (don't spend API/CI on unfinished PRs).
-    # To add more trusted owners, extend the head-owner check.
+    # jnasbyupgrade's own PRs only, and skip drafts (don't spend API/CI on
+    # unfinished PRs). To add more trusted authors, extend the user-login check.
     if: >-
       github.event.pull_request.draft == false &&
-      github.event.pull_request.head.repo.owner.login == 'jnasbyupgrade'
+      github.event.pull_request.user.login == 'jnasbyupgrade'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions: