diff --git a/src/utils/github-utils.ts b/src/utils/github-utils.ts
index 4f9ee51..8dca8fd 100644
--- a/src/utils/github-utils.ts
+++ b/src/utils/github-utils.ts
@@ -6,6 +6,8 @@ import * as github from '@actions/github'
 import {GitHub} from '@actions/github/lib/utils'
 import type {PullRequest, WorkflowRunEvent} from '@octokit/webhooks-types'
 
+type WorkflowRunPR = WorkflowRunEvent['workflow_run']['pull_requests'][number]
+
 export function getCheckRunContext(): {sha: string; runId: number} {
   if (github.context.eventName === 'workflow_run') {
     core.info('Action was triggered by workflow_run: using SHA and RUN_ID from triggering workflow')
@@ -13,8 +15,15 @@ export function getCheckRunContext(): {sha: string; runId: number} {
     if (!event.workflow_run) {
       throw new Error("Event of type 'workflow_run' is missing 'workflow_run' field")
     }
+    const prs = (event.workflow_run.pull_requests ?? []) as WorkflowRunPR[]
+    const prShaMatch = prs.find(pr => pr.head?.ref === event.workflow_run.head_branch)?.head?.sha
+    const prShaFirst = prs[0]?.head?.sha
+    const sha = prShaMatch ?? prShaFirst ?? event.workflow_run.head_sha
+    if (!sha) {
+      throw new Error('Unable to resolve SHA from workflow_run (no PR head.sha or head_sha)')
+    }
     return {
-      sha: event.workflow_run.head_commit.id,
+      sha,
       runId: event.workflow_run.id
     }
   }