diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 1e7330b..5e5b4c6 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,7 +13,15 @@ concurrency:
     cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
 jobs:
+    authorize:
+      name: Authorize
+      environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
+      runs-on: ubuntu-latest
+      steps:
+        - run: true
+
     test:
+        needs: authorize # Require approval before running on forked pull requests
         name: Test on ${{ matrix.platform.os }} using Xcode ${{ matrix.xcode }}
         runs-on: macos-13