diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index 9def6acffca50..4d739f4244068 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -21,6 +21,8 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Generate authentication token
+        # don't run this step if the PR is from a fork since the secrets won't exist
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         id: generate_token
         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
         with:
@@ -28,6 +30,8 @@ jobs:
           private_key: ${{ secrets.GH_APP_DATADOG_VECTOR_CI_APP_PRIVATE_KEY }}
 
       - name: Get PR comment author
+        # don't run this step if the PR is from a fork since the secrets won't exist
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         id: author
         uses: tspascoal/get-user-teams-membership@v3
         with:
@@ -36,6 +40,7 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
 
       - env:
+          # if the prior step did not run, this var will be ''
           AUTHOR_IS_TEAM_MEMBER: ${{ steps.author.outputs.isTeamMember }}
         run: |
           if [[ $PR_HAS_LABEL == 'true' ]] ; then