diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 7753d7d..28fbcdd 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -1,8 +1,9 @@
 name: dco
 
-# Every commit in a pull request from an outside contributor must carry a Signed-off-by
-# line: the Developer Certificate of Origin, as CONTRIBUTING.md asks. Maintainers' and
-# bots' pull requests skip the job, which counts as passing.
+# Every commit in a pull request from a fork must carry a Signed-off-by line: the
+# Developer Certificate of Origin, as CONTRIBUTING.md asks. A pull request from a
+# branch in this repository skips the job, which counts as passing: pushing that
+# branch already needed write access.
 on:
   pull_request:
 
@@ -16,9 +17,7 @@ concurrency:
 jobs:
   sign-off:
     name: DCO sign-off
-    if: >-
-      !contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)
-      && github.event.pull_request.user.type != 'Bot'
+    if: github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index aea8b12..5c26ebd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -180,7 +180,7 @@ Before submitting:
 
 ## Sign Off Your Commits
 
-Every commit in a pull request carries a `Signed-off-by:` line. It says you wrote the change or have the right to submit it under the project's licenses (AGPL-3.0-or-later for the plugin, Apache-2.0 for `r9cam_models` and the API specification): the [Developer Certificate of Origin 1.1](https://developercertificate.org/). `git commit -s` adds it; `git rebase --signoff upstream/main` (the branch you started from) adds it to commits you already made. The `dco` workflow fails a pull request from an outside contributor with a commit that lacks it. Organisation members' and the dependency bots' pull requests skip it.
+Every commit in a pull request carries a `Signed-off-by:` line. It says you wrote the change or have the right to submit it under the project's licenses (AGPL-3.0-or-later for the plugin, Apache-2.0 for `r9cam_models` and the API specification): the [Developer Certificate of Origin 1.1](https://developercertificate.org/). `git commit -s` adds it; `git rebase --signoff upstream/main` (the branch you started from) adds it to commits you already made. The `dco` workflow fails a pull request from a fork with a commit that lacks it. Pull requests from a branch in this repository skip it.
 
 ## Release Process