diff --git a/.github/workflows/utilities-unit-tests.yml b/.github/workflows/utilities-unit-tests.yml
index 95c2320186..5b70ab060f 100644
--- a/.github/workflows/utilities-unit-tests.yml
+++ b/.github/workflows/utilities-unit-tests.yml
@@ -15,6 +15,8 @@ jobs:
     name: Run Utilities Unit Tests
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # Org members run automatically; outside contributors need maintainer approval
+    environment: ${{ (github.event.pull_request.head.repo.full_name == github.repository || contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.pull_request.author_association)) && '' || 'external-pr-tests' }}
     permissions:
       contents: read
       pull-requests: read
@@ -27,6 +29,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
+          allow-unsafe-pr-checkout: true
 
       - name: Install uv
         uses: astral-sh/setup-uv@v8.2.0