diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
index cdcdef38..87ae798e 100644
--- a/.github/workflows/codex-review.yml
+++ b/.github/workflows/codex-review.yml
@@ -25,8 +25,13 @@ jobs:
   codex:
     name: Codex Review
     runs-on: ubuntu-latest
-    # Skip forks (no secret access) so they don't show a spurious failure.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Skip forks and Dependabot (neither gets secret access) so they don't show
+    # a spurious failure. Dependabot pushes to a same-repo branch, so the fork
+    # check below does not catch it — pull_request runs for Dependabot are
+    # withheld secrets, so the Codex step would fail with no OPENAI_API_KEY.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     permissions:
       contents: read
     outputs: