diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 264234a..c92b6f1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -82,12 +82,32 @@ jobs:
 
       - name: Upload SARIF
         # Only upload where the GITHUB_TOKEN can write security events: pushes to main
-        # and same-repo human PRs. Fork and Dependabot pull requests run with a
-        # read-only token, so the upload is skipped there - the gate step below still
-        # runs and blocks on findings. continue-on-error keeps the security gate
-        # independent of the upload: a transient code-scanning upload failure must not
-        # skip the "Fail on actionable findings" step below.
-        if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
+        # and pull requests from a branch on this repository. A fork's pull request
+        # runs with a read-only token, so the upload is skipped there - the gate step
+        # below still runs and blocks on findings. continue-on-error keeps the security
+        # gate independent of the upload: a transient code-scanning upload failure
+        # must not skip the "Fail on actionable findings" step below.
+        #
+        # THIS PARAGRAPH NAMED A DEPENDABOT PULL REQUEST BESIDE THE FORK AND THE RUN
+        # LOG REFUTES IT (#318). #312 took the same exclusion out of the other two
+        # uploads on this board on the reading of #256's run, and this file kept it.
+        # The proposal Dependabot opened as #317 ran this workflow with the write it
+        # was said not to have, and this step was the one step skipped:
+        #
+        #     gh run view 34809323213 --repo Flowfin/core --log | grep -oE 'SecurityEvents: (write|read)|Contents: read|Metadata: read' | sort -u
+        #     Contents: read
+        #     Metadata: read
+        #     SecurityEvents: write
+        #
+        #     gh api repos/Flowfin/core/actions/runs/34809323213/jobs --jq '.jobs[] | .steps[] | select(.name=="Upload SARIF") | .conclusion'
+        #     skipped
+        #
+        # So the condition below excludes the fork and nothing else. What the fork
+        # half rests on is not measured here and stays a claim. A failed upload on a
+        # head this condition now reaches is bounded by continue-on-error above, not
+        # by ordering: this step runs BEFORE the gating step, which is the difference
+        # .github/workflows/shell-analysis.yml names at its own upload.
+        if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository
         continue-on-error: true
         uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with: