diff --git a/README.md b/README.md
index 152ff53..e58339f 100644
--- a/README.md
+++ b/README.md
@@ -16,3 +16,7 @@ offline job. Its TLS key and raw input fixtures are never artifacts.
 
 Review job permissions and artifact inventories before changing tests. Keep
 one serialized root reporter per PR; no fork or privileged-target comment.
+
+Fork qualification uses a pull request into the public upstream repository:
+the integrated Action keeps its Form, reports, artifacts and Summary with the
+fork's reduced token, while PR commenting is skipped.
diff --git a/scripts/assert-output.mjs b/scripts/assert-output.mjs
index c112cc9..9c8fa7d 100644
--- a/scripts/assert-output.mjs
+++ b/scripts/assert-output.mjs
@@ -18,7 +18,7 @@ assert.equal(outputs.version, '0.1.0-pr.117.1');
 if (expectedCode !== undefined) assert.equal(outputs['exit-code'], expectedCode);
 if (process.env.ROOTFORM_EXPECT_ARTIFACT === 'true') {
   assert.match(outputs['artifact-id'], /^\d+$/);
-  assert.match(outputs['artifact-url'], /^https:\/\/github\.com\/rootform-dev\/action-qualification\/actions\/runs\/\d+\/artifacts\/\d+$/);
+  assert.equal(outputs['artifact-url'], `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}/artifacts/${outputs['artifact-id']}`);
 }
 if (process.env.ROOTFORM_PREVIOUS_FORM) {
   assert.equal(outputs.form, process.env.ROOTFORM_PREVIOUS_FORM, 'saved Form path must be reused');
diff --git a/scripts/prepare-registry.mjs b/scripts/prepare-registry.mjs
index 765da74..882df20 100644
--- a/scripts/prepare-registry.mjs
+++ b/scripts/prepare-registry.mjs
@@ -16,7 +16,7 @@ const home = join(root, 'selection-builder-home'); mkdirSync(home);
 const project = 'external-project'; mkdirSync(project);
 const layout = join(root, 'registry-layout');
 const auth = { ROOTFORM_HOME: home, SSL_CERT_FILE: join(tls,'cert.pem') };
-command('rootform',['package','policy-packs','fixtures/negative','--to',layout,'--source-url','https://github.com/rootform-dev/action-qualification','--revision',process.env.GITHUB_SHA,'--licenses','Apache-2.0'],auth);
+command('rootform',['package','policy-packs','fixtures/negative','--to',layout,'--source-url',`${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}`,'--revision',process.env.GITHUB_SHA,'--licenses','Apache-2.0'],auth);
 // Wait only for this owned registry's TLS readiness, with a bounded interval.
 for (let attempt=0; attempt<20; attempt++) {
   try { command('curl',['--fail','--silent','--cacert',join(tls,'cert.pem'),'https://localhost:5000/v2/']); break; }