diff --git a/.github/workflows/pull-request-helper.yml b/.github/workflows/pull-request-helper.yml
index ed9d0c0093..6cea3c42d7 100644
--- a/.github/workflows/pull-request-helper.yml
+++ b/.github/workflows/pull-request-helper.yml
@@ -1,14 +1,24 @@
 name: Pull request helper
 on:
-  push:
-    branches:
-      - 'dependabot/**/*'
+  pull_request_target:
 
 jobs:
   pull-request-helper:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          # this is the personal access token used for "git push" below
+          # which is needed in order to trigger workflows
+          token: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+
+      - name: Check out PR branch
+        env:
+          NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh pr checkout $NUMBER
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v5
@@ -20,6 +30,16 @@ jobs:
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
 
+      # - name: Spotless
+      #   env:
+      #     NUMBER: ${{ github.event.issue.number }}
+      #   run: |
+      #     ./gradlew spotlessApply
+      #     if git diff --quiet; then
+      #       exit 0 # success
+      #     fi
+      #     git commit -a -m "./gradlew spotlessApply"
+
       - name: Update license report
         env:
           NUMBER: ${{ github.event.issue.number }}
@@ -47,4 +67,7 @@ jobs:
           git commit -m "./gradlew resolveAndLockAll --write-locks"
 
       - name: Push
-        run: git push
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git push