diff --git a/.github/test-release-workflow.sh b/.github/test-release-workflow.sh
index 67f885e..080f5ef 100755
--- a/.github/test-release-workflow.sh
+++ b/.github/test-release-workflow.sh
@@ -170,9 +170,10 @@ for step in "Import signing certificate" "Tap token" "Check tap access" \
 done
 
 # The tap token is also taken on pull requests, on purpose: an app that lost
-# its installation fails the PR, not the release. Never on a dry run from
+# its installation fails the PR, not the release. Not on Dependabot PRs: they get
+# Dependabot secrets only, without TAP_APP_KEY (2026-11-07). Never on a dry run from
 # another branch - that branch's code has already run in earlier steps.
-TAP_PROBE="env.IS_RELEASE == 'true' || github.event_name == 'pull_request'"
+TAP_PROBE="env.IS_RELEASE == 'true' || (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')"
 # Publishing steps that read no secret themselves: the gate that stops a build
 # which changed tracked files, the release action (job token), git push with
 # the tap checkout's credentials.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ccffdf5..2f84af4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -319,10 +319,11 @@ jobs:
       # release: an app that lost its installation (or a missing key) fails
       # the PR, not the release after the DMG is already published. Not on a
       # dry run from another branch: its code has already run in the steps
-      # above and could read the token (2026-11-04).
+      # above and could read the token (2026-11-04). Not on Dependabot PRs:
+      # they get only Dependabot secrets, so TAP_APP_KEY is empty (2026-11-07).
       - name: Tap token
         id: tap-token
-        if: env.IS_RELEASE == 'true' || github.event_name == 'pull_request'
+        if: env.IS_RELEASE == 'true' || (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.TAP_APP_CLIENT_ID }}
@@ -331,7 +332,7 @@ jobs:
           repositories: homebrew-tap
 
       - name: Check tap access
-        if: env.IS_RELEASE == 'true' || github.event_name == 'pull_request'
+        if: env.IS_RELEASE == 'true' || (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
         env:
           TAP_TOKEN: ${{ steps.tap-token.outputs.token }}
         run: git ls-remote "https://x-access-token:${TAP_TOKEN}@github.com/RenaCode/homebrew-tap.git" HEAD