diff --git a/.github/workflows/build_3.3.0.yaml b/.github/workflows/build_3.3.0.yaml
index 63b1ab3..cb86d13 100644
--- a/.github/workflows/build_3.3.0.yaml
+++ b/.github/workflows/build_3.3.0.yaml
@@ -20,15 +20,18 @@
 name: "Build and Test (3.3.0)"
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - 'master'
     paths:
-      - '3.3.0/'
+      - '3.3.0/**'
+      - '.github/workflows/build_3.3.0.yaml'
       - '.github/workflows/main.yml'
 
 jobs:
   run-build:
+    permissions:
+      packages: write
     name: Run
     secrets: inherit
     uses: ./.github/workflows/main.yml
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 90bd706..df04456 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -41,6 +41,8 @@ on:
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     strategy:
       matrix:
         spark_version:
@@ -70,7 +72,9 @@ jobs:
       - name: Generate tags
         run: |
           TAG=scala${{ matrix.scala_version }}-java${{ matrix.java_version }}-${{ matrix.image_suffix }}
-
+          # The pull_request_target event leads to:
+          # 1. Use the `apache` in apache repo (push/pr).
+          # 2. Use the fork repo owner in fork repo PR.
           REPO_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
           TEST_REPO=ghcr.io/$REPO_OWNER/spark-docker
           IMAGE_NAME=spark
@@ -98,7 +102,7 @@ jobs:
         with:
           context: ${{ env.IMAGE_PATH }}
           push: true
-          tags: ${{ env.TEST_REPO }}:${{ env.UNIQUE_IMAGE_TAG }}
+          tags: ${{ env.TEST_REPO }}/${{ env.IMAGE_NAME }}:${{ env.UNIQUE_IMAGE_TAG }}
           platforms: linux/amd64,linux/arm64
 
       - name: Image digest