diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c752d9b2..8b31def04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -143,8 +143,9 @@ jobs:
           SQ_GITHUB_TEST_REPO: ${{ vars.SQ_GITHUB_TEST_REPO }}
           # Fail rather than skip when the secret is missing, but only in a
           # repository that set up a test repo (forks without one skip), and
-          # not on fork PRs, which GitHub never gives secrets to.
-          SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+          # not on fork PRs or Dependabot runs, which GitHub never gives
+          # repository secrets to.
+          SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         run: make e2e-test
 
       - name: Upload Bazel failure logs
@@ -258,8 +259,9 @@ jobs:
           SQ_GITHUB_TEST_REPO: ${{ vars.SQ_GITHUB_TEST_REPO }}
           # Fail rather than skip when the secret is missing, but only in a
           # repository that set up a test repo (forks without one skip), and
-          # not on fork PRs, which GitHub never gives secrets to.
-          SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+          # not on fork PRs or Dependabot runs, which GitHub never gives
+          # repository secrets to.
+          SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         run: make integration-test-runway-merger
 
       - name: Upload Bazel failure logs