diff --git a/.github/workflows/ci-breaking-changes.yaml b/.github/workflows/ci-breaking-changes.yaml
index b9a291d0da..172b919b85 100644
--- a/.github/workflows/ci-breaking-changes.yaml
+++ b/.github/workflows/ci-breaking-changes.yaml
@@ -1,10 +1,7 @@
 name: GraphQL and OpenAPI Breaking Changes Detection
 
 on:
-  # Using pull_request_target instead of pull_request to have access to secrets for external contributors
-  # Security note: This is safe because we're only analyzing API schemas and posting comments,
-  # not running untrusted code from the PR
-  pull_request_target:
+ pull_request:
     types: [opened, synchronize, edited]
     branches:
       - main
@@ -21,7 +18,6 @@ permissions:
   contents: read
   pull-requests: write
   checks: write
-  issues: write
 
 jobs:
   changed-files-check:
@@ -585,7 +581,6 @@ jobs:
         if: always()
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
             let hasChanges = false;