The update-docs workflow intermittently failed with "Input required and not supplied: token" because pull_request events from fork PRs don't have access to repository secrets. Switching to pull_request_target runs the workflow in the base repo's context, ensuring secrets are always available. This is safe since the workflow only runs on already-merged PRs.