diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1354c1ef3..04d2cf559 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,8 +6,8 @@ on:
   pull_request:
     # Run on all PRs, but skip for repo owner (runs local tests)
 
-# Skip CI for repo owner's PRs (they run tests locally)
-# This check is applied to all jobs below
+# Skip CI for PRs authored by repo owner (they run tests locally)
+# Uses PR author instead of triggering actor so rebasing by owner doesn't skip CI
 
 env:
   PYTHON_VERSION: '3.11'
@@ -30,7 +30,7 @@ jobs:
   backend-lint:
     name: Backend Lint
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     steps:
       - uses: actions/checkout@v4
 
@@ -51,7 +51,7 @@ jobs:
   backend-security:
     name: Backend Security
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -73,7 +73,7 @@ jobs:
   backend-tests:
     name: Backend Tests
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     needs: backend-lint
     steps:
       - uses: actions/checkout@v4
@@ -110,7 +110,7 @@ jobs:
   frontend-lint:
     name: Frontend Lint
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     steps:
       - uses: actions/checkout@v4
 
@@ -132,7 +132,7 @@ jobs:
   frontend-security:
     name: Frontend Security
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -155,7 +155,7 @@ jobs:
   frontend-typecheck:
     name: Frontend Type Check
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     steps:
       - uses: actions/checkout@v4
 
@@ -177,7 +177,7 @@ jobs:
   frontend-tests:
     name: Frontend Tests
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     needs: [frontend-lint, frontend-typecheck]
     steps:
       - uses: actions/checkout@v4
@@ -201,7 +201,7 @@ jobs:
   frontend-build:
     name: Frontend Build
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     needs: [frontend-tests]
     steps:
       - uses: actions/checkout@v4
@@ -228,7 +228,7 @@ jobs:
   docker-test:
     name: Docker Build
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.actor != github.repository_owner
+    if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
     timeout-minutes: 20
     needs: [backend-tests, frontend-build]
     steps: