diff --git a/.github/actions/install-internal-pip/action.yml b/.github/actions/install-internal-pip/action.yml
index e33107e585..b605bf54c0 100644
--- a/.github/actions/install-internal-pip/action.yml
+++ b/.github/actions/install-internal-pip/action.yml
@@ -2,8 +2,10 @@ name: Install internal repo via pip (SSH)
 description: pip install git+ssh from GHES
 inputs:
   ssh-private-key:
-    required: true
-    description: OpenSSH private key (with BEGIN/END)
+    required: false
+    description: >-
+      OpenSSH private key (with BEGIN/END). Empty on runs that cannot read repo
+      secrets (forks, Dependabot), in which case the install is skipped.
   host:
     required: false
     default: github.ibm.com
@@ -20,9 +22,15 @@ runs:
   using: composite
   steps:
     - shell: bash
+      env:
+        SSH_PRIVATE_KEY: ${{ inputs.ssh-private-key }}
       run: |
+        if [ -z "$SSH_PRIVATE_KEY" ]; then
+          echo "::notice title=Internal install skipped::No SSH key available (fork or Dependabot run); skipping ${{ inputs.repo }}. Metrics requiring it will raise a clear install error if used."
+          exit 0
+        fi
         mkdir -p ~/.ssh
-        echo "${{ inputs.ssh-private-key }}" > ~/.ssh/id_ed25519
+        printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
         ssh-keyscan "${{ inputs.host }}" >> ~/.ssh/known_hosts
         if [ -n "${{ inputs.ref }}" ]; then
@@ -33,5 +41,4 @@ runs:
         echo "Installing from URL: $URL"
         pip install --no-cache-dir --force-reinstall "$URL" ${{ inputs.pip-extra-args }}
         echo "Downgrading pydantic as required LLM eval kit library"
-        pip install pydantic==2.11.3 
-
+        pip install pydantic==2.11.3
diff --git a/.github/workflows/examples_tests.yml b/.github/workflows/examples_tests.yml
index e10d5f38b8..b98d7edfcb 100644
--- a/.github/workflows/examples_tests.yml
+++ b/.github/workflows/examples_tests.yml
@@ -48,9 +48,15 @@ jobs:
         ssh-private-key: ${{ secrets.LLMEVALKIT_SSH_KEY }}
 
     - name: Hugging Face Login
+      env:
+        HF_TOKEN_FOR_TESTS: ${{ secrets.UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS }}
       run: |
+        if [ -z "$HF_TOKEN_FOR_TESTS" ]; then
+          echo "::notice title=Hugging Face login skipped::No token available (fork or Dependabot run); continuing unauthenticated, which may hit Hub rate limits."
+          exit 0
+        fi
         for i in {1..5}; do
-          huggingface-cli login --token ${{ secrets.UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS }} && break || sleep $((2 ** i));
+          huggingface-cli login --token "$HF_TOKEN_FOR_TESTS" && break || sleep $((2 ** i));
         done
 
     - name: Run Tests
diff --git a/.github/workflows/inference_tests.yml b/.github/workflows/inference_tests.yml
index ddaba0baba..ed2b73662d 100644
--- a/.github/workflows/inference_tests.yml
+++ b/.github/workflows/inference_tests.yml
@@ -45,9 +45,15 @@ jobs:
       - run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - run: uv pip install --system ".[tests,watsonx,inference-tests]"
       - name: Hugging Face Login
+        env:
+          HF_TOKEN_FOR_TESTS: ${{ secrets.UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS }}
         run: |
+          if [ -z "$HF_TOKEN_FOR_TESTS" ]; then
+            echo "::notice title=Hugging Face login skipped::No token available (fork or Dependabot run); continuing unauthenticated, which may hit Hub rate limits."
+            exit 0
+          fi
           for i in {1..5}; do
-            huggingface-cli login --token ${{ secrets.UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS }} && break || sleep $((2 ** i));
+            huggingface-cli login --token "$HF_TOKEN_FOR_TESTS" && break || sleep $((2 ** i));
           done
       - name: Install Ollama
         run: curl -fsSL https://ollama.com/install.sh | sh
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index a58f02d757..a1adda46aa 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -40,9 +40,15 @@ jobs:
         uv pip install --system diskcache
 
     - name:  Hugging Face Login
+      env:
+        HF_TOKEN_FOR_TESTS: ${{ secrets.UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS }}
       run: |
+        if [ -z "$HF_TOKEN_FOR_TESTS" ]; then
+          echo "::notice title=Hugging Face login skipped::No token available (fork or Dependabot run); continuing unauthenticated, which may hit Hub rate limits."
+          exit 0
+        fi
         for i in {1..5}; do
-          huggingface-cli login --token ${{ secrets.UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS }} && break || sleep $((2 ** i));
+          huggingface-cli login --token "$HF_TOKEN_FOR_TESTS" && break || sleep $((2 ** i));
         done
     - name: Prepare the dirs for performance evaluation in main
       run: |