diff --git a/.github/workflows/check-sample.yml b/.github/workflows/check-sample.yml
index 5579a2b9..01131339 100644
--- a/.github/workflows/check-sample.yml
+++ b/.github/workflows/check-sample.yml
@@ -59,6 +59,12 @@ jobs:
 
       - name: Create / Update Template Repo
         uses: actions/github-script@v7
+        # Dependabot-triggered pull_request runs get no access to Actions secrets
+        # (GitHub restricts this the same way it does for fork PRs), so
+        # TEMPLATES_MANAGER_TOKEN is empty here and this step would always fail.
+        # Skip it so the required check_samples check reports "success" (skipped)
+        # instead of blocking dependabot-automerge on every dependency bump.
+        if: github.actor != 'dependabot[bot]'
         env:
           PUSH_TOKEN: ${{ secrets.TEMPLATES_MANAGER_TOKEN }}
         with:
diff --git a/.github/workflows/deploy-changed-samples.yml b/.github/workflows/deploy-changed-samples.yml
index 80d7a751..e2a9b678 100644
--- a/.github/workflows/deploy-changed-samples.yml
+++ b/.github/workflows/deploy-changed-samples.yml
@@ -69,7 +69,11 @@ jobs:
       - name: Deploy changed samples to staging
         id: deploy-samples
         shell: bash # implies set -o pipefail, so pipe below will keep the exit code from loadtest
-        if: env.should_continue == 'true'
+        # Dependabot-triggered pull_request runs get no access to Actions secrets
+        # (GitHub restricts this the same way it does for fork PRs), so this step
+        # would always fail here. Skip it so the required check reports "success"
+        # (skipped) instead of blocking dependabot-automerge on every bump.
+        if: env.should_continue == 'true' && github.actor != 'dependabot[bot]'
         env:
           FIXED_VERIFIER_PK: ${{ secrets.FIXED_VERIFIER_PK }}
           TEST_ALLOWED_HOSTS: ${{ secrets.TEST_ALLOWED_HOSTS }}
@@ -134,7 +138,7 @@ jobs:
           ./tools/testing/loadtest -c fabric-staging.defang.dev:443 --timeout=15m --concurrency=10 -s $SAMPLES -o output --markdown=true | tee output/summary.log | grep -v '^\s*[-*]' # removes load sample log lines
       - name: Upload Output as Artifact
         uses: actions/upload-artifact@v4
-        if: env.should_continue == 'true' && (success() || steps.deploy-samples.outcome == 'failure') # Always upload result unless cancelled
+        if: env.should_continue == 'true' && github.actor != 'dependabot[bot]' && (success() || steps.deploy-samples.outcome == 'failure') # Always upload result unless cancelled
         with:
           name: program-output
           path: output/**