diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f233d1b..c81ff025 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ on:
       - main
     tags:
       - "*"
-  pull_request_target:
+  pull_request:
   schedule:
     # Weekly Monday 9AM build
     # * is a special character in YAML so you have to quote this string
@@ -42,9 +42,10 @@ jobs:
       envs: |
         - linux: py311-jwst-xdist
         - linux: py311-romancal-xdist
-  report_diff_coverage:
+  report_diff_test_coverage:
     needs: [ test ]
-    if: github.event_name == 'pull_request_target'
+    if: always() && github.event_name == 'pull_request'
+    name: report diff test coverage
     runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-python@v5
@@ -59,6 +60,8 @@ jobs:
         with:
           pattern: ".coverage*"
           merge-multiple: true
+      - run: |
+          [ "$(ls -A .coverage*)" ] && exit 0 || exit 1
       - run: coverage xml
       - run: diff-cover coverage.xml --compare-branch origin/${{ github.base_ref }} --markdown-report diff_coverage.md
       - run: cat diff_coverage.md >> $GITHUB_STEP_SUMMARY
@@ -67,3 +70,4 @@ jobs:
           filePath: diff_coverage.md
           pr_number: ${{ github.event.number }}
           comment_tag: diff-coverage
+          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_COMMENTER_TOKEN }}