diff --git a/.github/workflows/two-human-reviewers.yml b/.github/workflows/two-human-reviewers.yml
index f8254d5..9498848 100644
--- a/.github/workflows/two-human-reviewers.yml
+++ b/.github/workflows/two-human-reviewers.yml
@@ -1,27 +1,9 @@
 name: Two human reviewers
-# The logic lives in c-build-tools so every repository shares one definition; see
-# `.github/workflows/two-human-reviewers.yml` there for why this is a workflow rather than a branch rule,
-# and for the `required-approvals` and `exempt-bots` inputs.
-#
-# Keep BOTH triggers below. A called workflow's own triggers are ignored, so these are what re-run the
-# gate; drop `pull_request_review` and it evaluates once at open, finds no approvals, and never re-runs
-# when someone approves - leaving the required check failing until an unrelated push happens to re-trigger
-# it.
-#
-# `pull_request_target` rather than `pull_request`, because the gate publishes its verdict as a commit
-# status and a pull request from a fork carries a read-only token on `pull_request`. It could never
-# publish for one, and the fork's pull request would then wait forever on a status that never arrives.
-# `pull_request_target` runs in the base repository's context, with a token that can write.
-#
-# That is only safe because the gate never checks out the pull request's code - it reads the API and
-# nothing else. Do not add a checkout here, and do not add one to the called workflow: with
-# `pull_request_target` that code would run with a writable token against the base repository.
-#
-# Do not add a required status check for this until the file is on the default branch, or every open pull
-# request will wait forever on a check that cannot run. Pull requests that were already open when it landed
-# get no event either, and are unstuck by reopening them, or by any push to them. Dispatching does not do
-# it: a dispatch runs against the default branch, so its check run attaches to that branch's commit rather
-# than to a pull request's head. It reports the verdict to the run log, and is useful for that.
+# Calls the shared gate in c-build-tools. Keep `pull_request_review`, or approvals never re-run it. A
+# fork's PR gets a read-only token (`pull_request_target` is blocked by default), so a maintainer
+# publishes its status with "Run workflow" or the command below, again after each push or review.
+# Never add a checkout.
+#   gh workflow run two-human-reviewers.yml -R <owner>/<repo> -f pr=<number>
 
 on:
   workflow_dispatch:
@@ -30,7 +12,7 @@ on:
         description: PR number to evaluate.
         type: string
         required: true
-  pull_request_target:
+  pull_request:
     types: [opened, reopened, synchronize, ready_for_review]
   pull_request_review:
     types: [submitted, dismissed]