diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c92b57b..a710394 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,8 +1,8 @@
 on:
   push:
     branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  pull_request_target:
+    types: [ labeled ]
 
 name: deploy
 
@@ -10,6 +10,9 @@ jobs:
   publish:
     name: Publish to Cloudflare Pages
     runs-on: ubuntu-latest
+    if: |
+      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'ok to test')) ||
+      (github.event_name != 'pull_request_target')
     permissions:
       contents: read
       deployments: write
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index fd71472..aa3083c 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -3,8 +3,8 @@ on:
     - cron: '0 0 * * *'
   push:
     branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  pull_request_target:
+    types: [ labeled ]
 
 name: build
 
@@ -15,6 +15,9 @@ jobs:
   build:
     name: Check on ${{ matrix.rust }}
     runs-on: ubuntu-latest
+    if: |
+      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'ok to test')) ||
+      (github.event_name != 'pull_request_target')
     strategy:
       matrix:
         rust: