diff --git a/.github/workflows/buf-ci.yaml b/.github/workflows/buf-ci.yaml
index f0ed3ec..f4d08fb 100644
--- a/.github/workflows/buf-ci.yaml
+++ b/.github/workflows/buf-ci.yaml
@@ -11,8 +11,12 @@ jobs:
   buf:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.2.0
-      - uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.0
+      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0
+        # Dependabot runs read the Dependabot secret store, so secrets.BUF_TOKEN is
+        # empty there and the BSR push fails. Nothing in a dependabot PR touches the
+        # protos, so skip the whole step.
+        if: github.actor != 'dependabot[bot]'
         with:
           # Publishing schema changes to the BSR requires a BSR authentication token.
           token: ${{ secrets.BUF_TOKEN }}