diff --git a/.github/workflows/test-throughput-comment.yaml b/.github/workflows/test-throughput-comment.yaml
new file mode 100644
index 00000000..d92643c4
--- /dev/null
+++ b/.github/workflows/test-throughput-comment.yaml
@@ -0,0 +1,57 @@
+name: Throughput test comment
+
+# Posts the throughput results as a PR comment.
+#
+# This is split out from test-throughput.yaml on purpose: for pull requests
+# opened from a fork, the GITHUB_TOKEN of the `pull_request` workflow is forced
+# read-only by GitHub, so it cannot comment (403 "Resource not accessible by
+# integration"). A `workflow_run` workflow instead runs in the context of the
+# base repository and gets a writable token, even when the triggering run came
+# from a fork.
+
+on:
+  workflow_run:
+    workflows: ["Throughput test"]
+    types:
+      - completed
+
+jobs:
+  comment:
+    name: Post throughput results comment
+    runs-on: ubuntu-latest
+    # Only act on runs that were triggered by a pull request.
+    if: github.event.workflow_run.event == 'pull_request'
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download comment payload
+        uses: actions/download-artifact@v4
+        with:
+          name: throughput-comment
+          path: ./comment
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Read payload
+        id: payload
+        run: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+          echo "pr_number=$(cat ./comment/pr_number.txt)" >> "$GITHUB_OUTPUT"
+          echo "sha=$(cat ./comment/sha.txt)" >> "$GITHUB_OUTPUT"
+          echo "baseline_link=$(cat ./comment/baseline_link.txt)" >> "$GITHUB_OUTPUT"
+          {
+            echo "table<<EOF"
+            cat ./comment/table.md
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+      - name: Post combined PR comment
+        uses: peter-evans/create-or-update-comment@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          issue-number: ${{ steps.payload.outputs.pr_number }}
+          body: |
+            Throughput results (`${{ steps.payload.outputs.sha }}`):
+            ${{ steps.payload.outputs.table }}
+
+            Baseline run: ${{ steps.payload.outputs.baseline_link }}
+          edit-mode: replace
diff --git a/.github/workflows/test-throughput.yaml b/.github/workflows/test-throughput.yaml
index 1ea7718a..74aa1bb2 100644
--- a/.github/workflows/test-throughput.yaml
+++ b/.github/workflows/test-throughput.yaml
@@ -80,7 +80,8 @@ jobs:
   aggregate:
     name: Aggregate and report throughput results
     runs-on: ubuntu-latest
-    permissions: write-all
+    permissions:
+      contents: read
     needs: test
     if: github.event_name == 'pull_request'
     steps:
@@ -133,7 +134,8 @@ jobs:
           if_no_artifact_found: warn
         continue-on-error: true
       - name: Aggregate and compare results
-        id: aggregate
+        env:
+          BASELINE_LINK: ${{ steps.baseline.outputs.link }}
         run: |
           #!/usr/bin/env bash
           set -euo pipefail
@@ -164,23 +166,21 @@ jobs:
           make_row "mongo" ./mongo/current/boom-*/wall_time.txt ./mongo/baseline/boom-*/wall_time.txt >> table.md
           make_row "s3" ./s3/current/boom-*/wall_time.txt ./s3/baseline/boom-*/wall_time.txt >> table.md
 
-          echo "table<<EOF" >> $GITHUB_OUTPUT
-          cat table.md >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
           cat results.txt || true
-      - name: Post combined PR comment
+
+          echo "${{ github.event.pull_request.number }}" > pr_number.txt
+          echo "${{ github.sha }}" > sha.txt
+          printf '%s' "$BASELINE_LINK" > baseline_link.txt
+      - name: Upload comment payload as artifact
         if: github.event_name == 'pull_request'
-        uses: peter-evans/create-or-update-comment@v5
+        uses: actions/upload-artifact@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.pull_request.number }}
-          body: |
-            Throughput results (`${{ github.sha }}`):
-            ${{ steps.aggregate.outputs.table }}
-
-            Baseline run: ${{ steps.baseline.outputs.link }}
-          edit-mode: replace
+          name: throughput-comment
+          path: |
+            table.md
+            pr_number.txt
+            sha.txt
+            baseline_link.txt
       - name: Fail if wall time increased too much (PR only)
         run: |
           TOL=${{ env.TOLERANCE_PERCENTAGE }}