diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 008c8307..83a5edc4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,18 +5,26 @@ on:
 
 jobs:
   build:
-    # only run in forks — non-fork PRs get a build via preview-deployment.yml
-    if: github.event.pull_request.head.repo.full_name != github.repository
+    # Runs wherever preview-deployment.yml cannot. Fork PRs and Dependabot PRs
+    # both get a read-only GITHUB_TOKEN with no access to secrets, so the
+    # preview deploy fails on them; this plain build is their only check.
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.repository ||
+      github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - name: Initialize examples submodule
+      # Same set as preview-deployment.yml. .sources/motoko is required: pages
+      # under docs/languages/motoko/ pull code via `file=<motokoExamples>/...`
+      # includes, and without the submodule they render empty without failing
+      # the build.
+      - name: Initialize submodules
         run: |
           git config --global url."https://github.com/".insteadOf "git@github.com:"
-          git submodule update --init --depth 1 .sources/examples
+          git submodule update --init --depth 1 .sources/examples .sources/motoko
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml
index 64b19f97..2c5c339f 100644
--- a/.github/workflows/pr-cleanup.yml
+++ b/.github/workflows/pr-cleanup.yml
@@ -5,8 +5,11 @@ on:
 
 jobs:
   release_preview_canister:
-    # do not run in forks
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Mirror preview-deployment.yml: only PRs that got a preview canister have
+    # one to release. Fork and Dependabot PRs never allocate one.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     concurrency:
       group: pr-${{ github.event.pull_request.number || github.event.number }}
diff --git a/.github/workflows/preview-deployment.yml b/.github/workflows/preview-deployment.yml
index 0247506e..32959001 100644
--- a/.github/workflows/preview-deployment.yml
+++ b/.github/workflows/preview-deployment.yml
@@ -5,8 +5,12 @@ on:
 
 jobs:
   build_and_deploy:
-    # do not run in forks
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Needs repo secrets and write access to post the preview comment, so skip
+    # any PR whose runs get a read-only token: forks and Dependabot. Those are
+    # covered by build.yml instead.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     concurrency:
       group: pr-${{ github.event.pull_request.number || github.event.number }}