diff --git a/.github/workflows/ci-trigger.yml b/.github/workflows/ci-trigger.yml
new file mode 100644
index 00000000..8530b18a
--- /dev/null
+++ b/.github/workflows/ci-trigger.yml
@@ -0,0 +1,15 @@
+name: CI trigger
+
+on:
+  pull_request:
+    branches: [ dev, main ]
+  push:
+    branches: [ dev, main ]
+
+jobs:
+  run-CI-workflow:
+    runs-on: ubuntu-latest
+    name: run CI workflow
+    steps:
+      - name: run
+        run: echo "this is a dummy workflow that triggers a workflow_run; it's necessary because otherwise the repo secrets will not be in scope for externally forked pull requests"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ac03d96..1a950656 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,9 @@
-name: CI triggered by PR
+name: CI triggered by CI trigger
 
 on:
-  pull_request:
-    branches:
-      - dev
-      - main
+  workflow_run:
+    workflows: [CI trigger]
+    types: [completed]
 
 jobs:
   ci: