diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index e4ca46f9..5467ad18 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -105,8 +105,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
+          # Dependabot and fork PRs can't read SONAR_TOKEN; skip the analysis
+          # there instead of failing the job after the tests pass.
+          SONAR_SKIP=false
+          if [ -z "$SONAR_TOKEN" ]; then SONAR_SKIP=true; fi
           mvn --batch-mode verify \
             org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
+            -Dsonar.skip="$SONAR_SKIP" \
             -Dmaven.antrun.skip -Dsonar.projectKey=opentdf_java-sdk \
             -P 'coverage,non-fips,!fips'
 
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index dd42d9f8..d013aad8 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -25,6 +25,8 @@ jobs:
 
     - name: Buf setup
       uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Initialize the CodeQL tools for scanning
       uses: github/codeql-action/init@v3