diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index f0d869b1..c40fbb87 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -38,7 +38,12 @@ jobs:
       -
         name: Login to DockerHub
         uses: docker/login-action@v1
-        if: "! github.event.pull_request.head.repo.fork"
+        # Skip when the run has no access to the DOCKERHUB_* secrets, which would
+        # otherwise fail the login with empty credentials: PRs from forks, and
+        # Dependabot PRs (those resolve secrets against the separate Dependabot
+        # store, not the Actions store). Neither run pushes an image anyway --
+        # see the `push:` condition on the build step below.
+        if: "! github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]'"
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}