diff --git a/.github/workflows/generate-sdk.yaml b/.github/workflows/generate-sdk.yaml
index a78dbc49f..94a41ff74 100644
--- a/.github/workflows/generate-sdk.yaml
+++ b/.github/workflows/generate-sdk.yaml
@@ -37,7 +37,7 @@ jobs:
       github.actor != 'github-actions[bot]' &&
       github.actor != 'trueforge-dev-bot[bot]'
     permissions:
-      contents: write
+      contents: read
 
     steps:
       - name: Create GitHub App token
@@ -109,7 +109,7 @@ jobs:
         if: steps.decide.outputs.needed == 'true'
         run: pnpm sdk:generate
 
-      # Forks get a read-only token, so only the commit is skipped. TODO: an approval flow that can push to the fork.
+      # Same-repo only: App token can push. Forks have no secrets / cannot write the fork head.
       - name: Commit generated output
         if: steps.decide.outputs.needed == 'true' && steps.app-token.outcome == 'success'
         # Passed as env, never interpolated into the script, so it cannot inject shell.
@@ -141,7 +141,24 @@ jobs:
           git commit -m "Regenerate OpenAPI document and TypeScript SDK"
           git push origin "HEAD:refs/heads/$BRANCH"
 
-      - name: Report skipped commit on fork
+      # Forks cannot receive the App push (no secrets; App is not installed on the fork).
+      # Hard-fail if generated output is stale; ask for the changeset in the same message
+      # (no merge-base/changeset heuristics — those false-positive on unsynced forks).
+      - name: Fail if generated output is missing on fork
         if: steps.decide.outputs.needed == 'true' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
         run: |
-          echo "::notice::Generation succeeded. The commit was skipped because pull requests from forks cannot push; a maintainer will regenerate after merge."
+          set -euo pipefail
+
+          # After CI ran sdk:generate, the tree must match what a same-repo commit would
+          # have pushed. Dirty → fork head is stale (we cannot push to the fork).
+          dirty="$(git status --porcelain -- .github/fern/openapi docs/openapi.json packages/sdk pnpm-lock.yaml)"
+          if [ -n "$dirty" ]; then
+            echo "::error::OpenAPI/SDK out of date on this fork PR. Run and commit:"
+            echo "  pnpm sdk:generate"
+            echo "  pnpm changeset:sdk-regen   # if packages/sdk changed (not only .fern)"
+            echo "Then push to your fork."
+            echo "$dirty"
+            exit 1
+          fi
+
+          echo "::notice::Fork PR generated output matches. If this PR changed packages/sdk (not only .fern), ensure you also committed: pnpm changeset:sdk-regen"