diff --git a/src/auth.go b/src/auth.go
index 59628c3..e9310e7 100644
--- a/src/auth.go
+++ b/src/auth.go
@@ -619,6 +619,10 @@ func authorizeForgejoActionRun(repoURL string, forgeToken string, prNumber strin
 	if actionRun.PullRequest == nil {
 		return nil, AuthError{http.StatusUnauthorized, "workflow run not triggered by pull request"}
 	}
+	prOwner, prRepository := actionRun.PullRequest.OwnerName, actionRun.PullRequest.RepositoryName
+	if fmt.Sprintf("%s/%s.git", prOwner, prRepository) != parsedRepoURL.Path {
+		return nil, AuthError{http.StatusUnauthorized, "pull request repository does not match"}
+	}
 	if fmt.Sprintf("%d", actionRun.PullRequest.Number) != prNumber {
 		return nil, AuthError{http.StatusUnauthorized, "pull request number does not match"}
 	}