diff --git a/.github/workflows/web-deploy.yml b/.github/workflows/web-deploy.yml
index 0fcd387683..3baca4268c 100644
--- a/.github/workflows/web-deploy.yml
+++ b/.github/workflows/web-deploy.yml
@@ -81,7 +81,9 @@ jobs:
         # Dependabot: the Build step above still runs and validates the bump;
         # we just don't push a per-PR preview deploy for it. Non-PR events
         # (push to develop, repository_dispatch) keep deploying as before.
-        if: github.actor != 'dependabot[bot]'
+        if: |
+          github.actor != 'dependabot[bot]'
+          && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
         working-directory: web
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/web/sites/guides/src/content/docs/v4-2-0/digging-deeper/sending-email.mdx b/web/sites/guides/src/content/docs/v4-2-0/digging-deeper/sending-email.mdx
index f5ce669b60..b18c2ad32a 100644
--- a/web/sites/guides/src/content/docs/v4-2-0/digging-deeper/sending-email.mdx
+++ b/web/sites/guides/src/content/docs/v4-2-0/digging-deeper/sending-email.mdx
@@ -295,7 +295,7 @@ Use a `.html` or `.txt` extension and open the file in a browser or editor. To p
 
 ## Third-party services
 
-Postmark, SendGrid, AWS SES, Mailgun — they all expose an SMTP endpoint. The mailer code above doesn't change per-provider; only the `server`, `port`, `username`, `password` defaults do.
+Postmark, SendGrid, AWS SES, Mailgun, Groundmail — they all expose an SMTP endpoint. The mailer code above doesn't change per-provider; only the `server`, `port`, `username`, `password` defaults do.
 
 | Provider | Server | Port | Username | Password |
 |----------|--------|------|----------|----------|
@@ -303,9 +303,14 @@ Postmark, SendGrid, AWS SES, Mailgun — they all expose an SMTP endpoint. The m
 | **SendGrid** | `smtp.sendgrid.net` | 587 | `apikey` (literal) | your API key |
 | **AWS SES** | `email-smtp.<region>.amazonaws.com` | 587 | SES SMTP username | SES SMTP password |
 | **Mailgun** | `smtp.mailgun.org` | 587 | `postmaster@<domain>` | Mailgun SMTP password |
+| **Groundmail** | `smtp.groundmail.dev` | 587 (or 2525) | `groundmail` (literal) | an SMTP credential (`gmsmtp_…`) |
+
+*Disclosure: the Groundmail row was contributed by the Groundmail team.*
 
 Each provider has its own sender-verification and domain-setup flow (SPF, DKIM, DMARC). Follow their docs for that — the framework side is just SMTP.
 
+Groundmail's sandbox sends only from `noreply@mail.groundmail.dev` to your own account email until you verify a sending domain and add a payment method; other recipients get a 403. See [Groundmail's SMTP docs](https://docs.groundmail.dev/smtp).
+
 ## Related guides
 
 <CardGrid>