diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml
index d0221f95..36b61cda 100644
--- a/.github/workflows/merge-bot-pull-request.yml
+++ b/.github/workflows/merge-bot-pull-request.yml
@@ -2,6 +2,7 @@ name: Merge bot pull request action
 
 on:
   pull_request:
+    types: [opened, reopened, synchronize]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -35,7 +36,7 @@ jobs:
   merge-codegen:
     name: Merge codegen pull request job
     runs-on: ubuntu-latest
-    if: github.event.pull_request.user.login == 'ptr727' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository
+    if: github.actor == 'ptr727' && github.event.pull_request.user.login == 'ptr727' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write
       pull-requests: write
diff --git a/README.md b/README.md
index c0f9193f..cc02858d 100644
--- a/README.md
+++ b/README.md
@@ -389,7 +389,12 @@ Licensed under the [MIT License][license-link]\
     - Pull requests: Read & write — to create the PR
     - Workflows: Read & write — this is the key permission that allows the token to trigger `pull_request` events in other workflows; without it the auto-merge workflow never fires
     - Metadata: Read-only (auto-required)
-  - The auto-merge condition gates on `github.event.pull_request.user.login` matching the PAT owner's GitHub username (`ptr727`), so only PRs created by this token on the `codegen` branch are eligible for auto-merge.
+  - The auto-merge condition in `merge-bot-pull-request.yml` requires all of the following to be true:
+    - `github.actor == 'ptr727'` — the event was triggered by the PAT owner (guards against a collaborator pushing to the branch after PR creation)
+    - `github.event.pull_request.user.login == 'ptr727'` — the PR was created by the PAT owner
+    - `github.event.pull_request.head.ref == 'codegen'` — the source branch is `codegen`
+    - `github.event.pull_request.base.ref == 'main'` — the PR targets `main`
+    - `github.event.pull_request.head.repo.full_name == github.repository` — the PR is from the same repository (not a fork)
   - Save the PAT as `WORKFLOW_PAT` in:
     - GitHub project security Settings / Secrets / Actions.