diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9163f49..93d309c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## 2.6.0
+* Fix: For `workflow_run` events, resolve the commit of the check run from related pull request head commits first (matching `workflow_run.head_branch`, then first PR), and fall back to `workflow_run.head_sha` for non-PR runs https://github.com/dorny/test-reporter/pull/673
+
 ## 2.5.0
 * Feature: Add Nette Tester support with `tester-junit` reporter https://github.com/dorny/test-reporter/pull/707
 * Maintenance: Bump actions/upload-artifact from 5 to 6 https://github.com/dorny/test-reporter/pull/695
diff --git a/dist/index.js b/dist/index.js
index b24a507..773e3e1 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -2947,8 +2947,18 @@ function getCheckRunContext() {
         if (!event.workflow_run) {
             throw new Error("Event of type 'workflow_run' is missing 'workflow_run' field");
         }
+        const prs = event.workflow_run.pull_requests ?? [];
+        // For `workflow_run`, we want to report against the PR commit when possible so annotations land
+        // on the contributor's changes. Prefer the PR whose `head.ref` matches `workflow_run.head_branch`,
+        // then fall back to the first PR head SHA, and finally to `workflow_run.head_sha` for non-PR runs.
+        const prShaMatch = prs.find(pr => pr.head?.ref === event.workflow_run.head_branch)?.head?.sha;
+        const prShaFirst = prs[0]?.head?.sha;
+        const sha = prShaMatch ?? prShaFirst ?? event.workflow_run.head_sha;
+        if (!sha) {
+            throw new Error('Unable to resolve SHA from workflow_run (no PR head.sha or head_sha)');
+        }
         return {
-            sha: event.workflow_run.head_commit.id,
+            sha,
             runId: event.workflow_run.id
         };
     }
diff --git a/src/utils/github-utils.ts b/src/utils/github-utils.ts
index 4f9ee51..d1539d9 100644
--- a/src/utils/github-utils.ts
+++ b/src/utils/github-utils.ts
@@ -13,8 +13,18 @@ export function getCheckRunContext(): {sha: string; runId: number} {
     if (!event.workflow_run) {
       throw new Error("Event of type 'workflow_run' is missing 'workflow_run' field")
     }
+    const prs = event.workflow_run.pull_requests ?? []
+    // For `workflow_run`, we want to report against the PR commit when possible so annotations land
+    // on the contributor's changes. Prefer the PR whose `head.ref` matches `workflow_run.head_branch`,
+    // then fall back to the first PR head SHA, and finally to `workflow_run.head_sha` for non-PR runs.
+    const prShaMatch = prs.find(pr => pr.head?.ref === event.workflow_run.head_branch)?.head?.sha
+    const prShaFirst = prs[0]?.head?.sha
+    const sha = prShaMatch ?? prShaFirst ?? event.workflow_run.head_sha
+    if (!sha) {
+      throw new Error('Unable to resolve SHA from workflow_run (no PR head.sha or head_sha)')
+    }
     return {
-      sha: event.workflow_run.head_commit.id,
+      sha,
       runId: event.workflow_run.id
     }
   }