diff --git a/.github/workflows/firmware.yml b/.github/workflows/firmware.yml
index 9a094d3..8ae40d3 100644
--- a/.github/workflows/firmware.yml
+++ b/.github/workflows/firmware.yml
@@ -52,13 +52,15 @@ jobs:
         uses: actions/checkout@v4 # v4
         with:
           fetch-depth: 0
+          # This adds support for both `pull_request_target` and `push` events.
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: Install build dependencies
         run: |
           sudo -E ./scripts/install_build_dependencies.sh
       - name: build target ${{ matrix.target }}
         id: compile
         run: |
-          git checkout -b patched ${GITHUB_SHA}
+          git checkout -b patched ${{ github.event.pull_request.head.sha || github.sha }}
           make BROKEN=1 GLUON_TARGETS=${{ matrix.target }} BUILD_NUMBER=${{ github.event.pull_request.number && format('pr{0}', github.event.pull_request.number) || github.run_id && format('run{0}', github.run_id) }} V=s
           echo "status=success" >> $GITHUB_OUTPUT
       - name: Upload firmware ${{ matrix.target }}