diff --git a/.github/workflows/build-pypilibrary-task.yml b/.github/workflows/build-pypilibrary-task.yml
index 2a483877..fdb05c08 100644
--- a/.github/workflows/build-pypilibrary-task.yml
+++ b/.github/workflows/build-pypilibrary-task.yml
@@ -22,7 +22,6 @@ jobs:
   get-version:
     name: Get version information job
     uses: ./.github/workflows/get-version-task.yml
-    secrets: inherit
 
   build-pypilibrary:
     name: Build PyPI library project job
diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml
index 536f4dbe..29d58ca7 100644
--- a/.github/workflows/merge-bot-pull-request.yml
+++ b/.github/workflows/merge-bot-pull-request.yml
@@ -86,8 +86,15 @@ jobs:
     runs-on: ubuntu-latest
     # Restrict to codegen PRs that originate from the App in this repository.
     # Codegen always opens PRs against `main` from the `codegen` branch.
+    # Both the PR author AND the event actor must be the App: the author
+    # check stops human-opened PRs that happen to target the `codegen`
+    # branch from auto-merging; the actor check stops a maintainer
+    # pushing extra commits to the App's `codegen` branch (a
+    # `synchronize` event the human triggered) from auto-merging
+    # unintended changes through the App PR.
     if: >-
       github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
+      github.actor == 'ptr727-codegen[bot]' &&
       github.event.pull_request.head.ref == 'codegen' &&
       github.event.pull_request.base.ref == 'main' &&
       github.event.pull_request.head.repo.full_name == github.repository