diff --git a/.github/workflows/browser-tests.yml b/.github/workflows/browser-tests.yml
index 5e2b6e2541..65c7d8d654 100644
--- a/.github/workflows/browser-tests.yml
+++ b/.github/workflows/browser-tests.yml
@@ -35,9 +35,12 @@ jobs:
       - name: "Define testing strategy"
         uses: actions/github-script@v8
         id: define
+        env:
+          browserstack: ${{ secrets.BROWSERSTACK_USER_NAME }}
         with:
           script: |
             const fs = require('node:fs/promises');
+            const process = require('process');
             const browsers = Object.entries(
               require('./.github/workflows/browser_testing.json')
             ).flatMap(([name, browser]) => {
@@ -56,11 +59,18 @@ jobs:
               .filter(([name, def]) => browsers.find(({bsName, version}) => bsName === def.browser && version === def.browser_version) == null)
             )
             const updatedBrowsersJson = JSON.stringify(bstackBrowsers, null,  2);
-            console.log("Using browsers.json:", updatedBrowsersJson);
+            let bsBrowsers;
+            if (process.env.browserstack) {
+              console.log("Using browsers.json:", updatedBrowsersJson);
+              bsBrowsers = Object.keys(bstackBrowsers).length;
+            } else {
+              console.log("Skipping browserstack tests (credentials are not available)");
+              bsBrowsers = 0;
+            }
             console.log("Browsers to be tested directly on runners:", JSON.stringify(browsers, null, 2))
             await fs.writeFile('./browsers.json', updatedBrowsersJson);
             return {
-              bsBrowsers: Object.keys(bstackBrowsers).length,
+              bsBrowsers,
               browsers,
               latestBrowsers: browsers.filter(browser => browser.version === 'latest') 
             }
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 54a41e2594..1209ca2057 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,7 +5,7 @@ on:
     branches:
       - master
       - '*-legacy'
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened]
 
 concurrency:
@@ -32,7 +32,7 @@ jobs:
 
       - name: Checkout code (PR)
         id: checkout-pr
-        if: ${{ github.event_name == 'pull_request_target' }}
+        if: ${{ github.event_name == 'pull_request' }}
         uses: actions/checkout@v6
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/head