diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index ec11e58..44f0f9c 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -23,6 +23,9 @@ jobs:
 
     runs-on: ${{ matrix.os }}
 
+    permissions:
+      contents: write
+
     steps:
       - uses: actions/checkout@v3
       - name: Use Node.js ${{ matrix.node-version }}
@@ -37,5 +40,14 @@ jobs:
         run: npm run test:cov
 
       - name: Update Coverage Badge
-        if: ${{ matrix.os == 'ubuntu-22.04' && matrix.node-version == 18 }}
+        # Is there a way to tell if a PR is from a forked repository? #26829
+        # https://github.com/orgs/community/discussions/26829#discussioncomment-3253580
+        if: >-
+          matrix.os == 'ubuntu-22.04' && matrix.node-version == 18 && ((
+            github.event_name == 'pull_request' &&
+            github.event.pull_request.head.repo.full_name == github.repository
+          ) || (
+            github.event_name == 'pull_request_target' &&
+            github.event.pull_request.head.repo.full_name != github.repository
+          ))
         uses: we-cli/coverage-badge-action@main