diff --git a/.github/actions/deploy-static/action.yml b/.github/actions/deploy-static/action.yml
index 1a0513d..c0dbad8 100644
--- a/.github/actions/deploy-static/action.yml
+++ b/.github/actions/deploy-static/action.yml
@@ -14,6 +14,10 @@ inputs:
   target-path:
     description: Path prefix on the deployment URL
     required: true
+  commit-sha:
+    description: Commit SHA used in the deployment path
+    required: false
+    default: ${{ github.event.pull_request.head.sha }}
 
 outputs:
   preview-url:
@@ -32,9 +36,9 @@ runs:
       id: deployment-path
       shell: bash
       run: |
-        echo "deployment-path=${{ github.event.repository.name }}/${{ github.event.pull_request.head.sha }}/${{ inputs.target-path }}/" >> $GITHUB_OUTPUT
+        echo "deployment-path=${{ github.event.repository.name }}/${{ inputs.commit-sha }}/${{ inputs.target-path }}/" >> $GITHUB_OUTPUT
     - name: Deploy content
       id: deploy
       shell: bash
       run: |
-        aws s3 cp ${{ inputs.source-path }} s3://${{ inputs.deployment-bucket }}/${{ steps.deployment-path.outputs.deployment-path }} --recursive
+        aws s3 cp ${{ inputs.source-path }} s3://${{ inputs.deployment-bucket }}/${{ steps.deployment-path.outputs.deployment-path }} --recursive --no-follow-symlinks
diff --git a/.github/workflows/deploy-fork-preview.yml b/.github/workflows/deploy-fork-preview.yml
new file mode 100644
index 0000000..3eaf740
--- /dev/null
+++ b/.github/workflows/deploy-fork-preview.yml
@@ -0,0 +1,44 @@
+name: Deploy fork preview
+
+on:
+  workflow_call:
+    inputs:
+      artifact-name:
+        description: Artifact to download/deploy; also the target path and the `fork-` environment suffix
+        type: string
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+  deployments: write
+  actions: read
+
+jobs:
+  deploy:
+    if: >
+      ${{ github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name }}
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    environment:
+      name: fork-${{ inputs.artifact-name }}
+      url: ${{ steps.deploy.outputs.preview-url }}index.html
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: build
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+      - name: Deploy dev-pages
+        id: deploy
+        uses: cloudscape-design/actions/.github/actions/deploy-static@main
+        with:
+          role-to-assume: ${{ secrets.AWS_PREVIEW_ROLE_ARN }}
+          deployment-bucket: ${{ secrets.AWS_PREVIEW_BUCKET_NAME }}
+          source-path: build
+          target-path: ${{ inputs.artifact-name }}
+          commit-sha: ${{ github.event.workflow_run.head_sha }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f970d7b..5664731 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -19,7 +19,9 @@ permissions:
 
 jobs:
   deploy:
-    if: github.event_name == 'pull_request'
+    if: >
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     continue-on-error: true
     environment: