diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml
index cded23c..2baadce 100644
--- a/.github/workflows/flake-update.yml
+++ b/.github/workflows/flake-update.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: nix
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: nix flake update -L
 
diff --git a/ci.py b/ci.py
index 53b1b40..6b0fd59 100644
--- a/ci.py
+++ b/ci.py
@@ -481,10 +481,10 @@ def open_pr(args):
     if push.returncode != 0:
         raise RuntimeError(f"git push failed:\n{push.stderr}")
 
-    owner = os.environ["REPO"].split("/")[0]
-    existing = gitea("GET", f"/pulls?state=open&head={owner}:{args.branch}")
+    pulls = gitea("GET", "/pulls?state=open")
+    existing = next((pr for pr in pulls if pr["head"]["ref"] == args.branch), None)
     if existing:
-        print(f"PR #{existing[0]['number']} already open, pushed update")
+        print(f"PR #{existing['number']} already open, pushed update")
         return
     labels = [label_id(args.label)] if args.label else []
     pr = gitea("POST", "/pulls",