diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
index a6904c9..d09bc90 100644
--- a/.github/workflows/sonar-scan.yml
+++ b/.github/workflows/sonar-scan.yml
@@ -15,5 +15,12 @@ concurrency:
 
 jobs:
   sonarcloud:
+    # SonarCloud needs the SONAR_TOKEN secret, which GitHub does not expose to
+    # pull requests from forks. Skip the scan for fork PRs so they report a
+    # neutral "skipped" status instead of a hard failure; it still runs on pushes
+    # to main and on same-repo pull requests.
+    if: >-
+      github.event_name == 'push' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     uses: ./.github/workflows/sonarcloud.yml
     secrets: inherit
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index b791410..6deb2de 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -11,7 +11,7 @@ on:
     secrets:
       SONAR_TOKEN:
         description: "SonarCloud analysis token"
-        required: true
+        required: false
 
 permissions:
   contents: read
@@ -25,7 +25,19 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      - name: Check for SonarCloud token
+        id: token
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          if [ -n "$SONAR_TOKEN" ]; then
+            echo "available=true" >>"$GITHUB_OUTPUT"
+          else
+            echo "available=false" >>"$GITHUB_OUTPUT"
+            echo "::notice::SONAR_TOKEN is not available (e.g. a fork pull request); skipping SonarCloud scan."
+          fi
       - name: SonarCloud Scan
+        if: steps.token.outputs.available == 'true'
         uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}