diff --git a/.github/workflows/nemesis.yml b/.github/workflows/nemesis.yml
index c2274a7d5f..5501fc0da6 100644
--- a/.github/workflows/nemesis.yml
+++ b/.github/workflows/nemesis.yml
@@ -3,7 +3,7 @@ name: Rust
 on:
   push:
     branches: [ "main" ]
-  pull_request:
+  pull_request_target:
   merge_group:
     branches: [ "main" ]
 
@@ -15,8 +15,17 @@ env:
   # RUSTFLAGS: "-D warnings"
 
 jobs:
-  test-nemesis:
+  authorize:
+    environment: ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
     runs-on: ubuntu-latest
+    steps:
+      - run: true
+
+  test-nemesis:
+    needs: authorize
+    runs-on: self-hosted
     name: Run Nemesis Tests
     env:
       RUSTFLAGS: -D warnings
@@ -33,30 +42,15 @@ jobs:
 
       - uses: actions/checkout@v3
 
-      - name: Set up cargo cache
-        uses: actions/cache@v3
-        continue-on-error: false
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
-
-      - name: Cargo build
+      - name: Run nemesis tests
         run: |
-          cargo build
-          mv ./target/debug/sqld /usr/local/bin
-          sqld --version
+          echo $PATH
 
       - name: Download MinIO binary
         run: |
           wget -q https://dl.min.io/server/minio/release/linux-amd64/minio -O minio
           chmod +x minio
-          mv minio /usr/local/bin
+          mv minio /home/ubuntu/.cargo/bin
           minio --version
 
       - name: Nemesis tests checkout
@@ -75,6 +69,25 @@ jobs:
           cd nemesis-tests
           go build -o ../tursotests cmd/tursotest/main.go
 
+      - name: Set up cargo cache
+        uses: actions/cache@v3
+        continue-on-error: false
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: Cargo build
+        run: |
+          cargo build
+          mv ./target/debug/sqld /home/ubuntu/.cargo/bin
+          sqld --version
+
       - name: Run nemesis tests
         run: |
           ./tursotests nemesis local
\ No newline at end of file