diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index f9aca5a9f..0bc5df898 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -20,6 +20,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           persist-credentials: false
       - name: get changelog version
         id: get-version
diff --git a/.github/workflows/build-distribution.yml b/.github/workflows/build-distribution.yml
index bfac0e866..0cbe4751f 100644
--- a/.github/workflows/build-distribution.yml
+++ b/.github/workflows/build-distribution.yml
@@ -27,6 +27,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
@@ -68,6 +69,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
@@ -164,6 +166,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
@@ -369,6 +372,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 0391162e7..83903cd45 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -11,6 +11,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
 
       - name: check PR description for AI co-author pattern
diff --git a/.github/workflows/doc-check.yml b/.github/workflows/doc-check.yml
index 293d78418..8d2a02048 100644
--- a/.github/workflows/doc-check.yml
+++ b/.github/workflows/doc-check.yml
@@ -61,6 +61,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           persist-credentials: false
 
       - uses: linuxdeepin/action-doxygencheck@master
diff --git a/.github/workflows/dtk-unittest.yml b/.github/workflows/dtk-unittest.yml
index 736089984..e4c3c45be 100644
--- a/.github/workflows/dtk-unittest.yml
+++ b/.github/workflows/dtk-unittest.yml
@@ -25,6 +25,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
 
diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml
index 6c6c33433..a74b6accf 100644
--- a/.github/workflows/license-check.yml
+++ b/.github/workflows/license-check.yml
@@ -11,6 +11,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
 
       - name: Setup Python
         id: python
@@ -118,6 +119,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - name: Install zsh
         run: |
           sudo sed -i 's/azure.archive.ubuntu.com/mirrors.layeronline.com/g' /etc/apt/sources.list
@@ -150,6 +152,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: zccrs/github-actions-spdx-checker@main
         with:
           include: '*.py,*.js,*.jsx,*.tsx,*.java,*.cpp,*.c,*.h,*.hpp,*.go,*.rs,*.rb,*.php,*.sh,*.xml,*.yaml,*.yml,*.qml,CMakeLists.txt,Makefile'