diff --git a/.github/workflows/buf-pull-request.yml b/.github/workflows/buf-pull-request.yml
index 48faa1a666..416cc6a0cf 100644
--- a/.github/workflows/buf-pull-request.yml
+++ b/.github/workflows/buf-pull-request.yml
@@ -1,5 +1,11 @@
 name: Protobuf
-on: pull_request
+on:
+  # Exclude feature branches, only run if the PR is targeting main.
+  pull_request_target:
+    types:
+      - opened
+    branches:
+      - "main"
 jobs:
   lint:
     name: Lint protobuf
@@ -55,7 +61,7 @@ jobs:
           toolchain: stable
           override: false
 
-      - uses: bufbuild/buf-setup-action@v1.27.1
+      - uses: bufbuild/buf-setup-action@v1
         with:
           buf_api_token: ${{ secrets.BUF_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}