diff --git a/.github/workflows/array-stack-check.yml b/.github/workflows/array-stack-check.yml
index 06f7075..a658e7b 100644
--- a/.github/workflows/array-stack-check.yml
+++ b/.github/workflows/array-stack-check.yml
@@ -1,5 +1,6 @@
 # Generated by Array CLI - https://github.com/posthog/array
-# Blocks PRs until their downstack dependencies are merged
+# Blocks stacked PRs until their downstack dependencies are merged
+# Only runs for PRs managed by Array (detected via stack comment marker)
 
 name: Stack Check
 
@@ -9,21 +10,44 @@ on:
   pull_request_target:
     types: [closed]
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
+    permissions:
+      pull-requests: read
+      issues: read
     steps:
       - name: Check stack dependencies
         uses: actions/github-script@v7
         with:
           script: |
             const pr = context.payload.pull_request;
+
+            // Check if this is an Array-managed PR by looking for stack comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number
+            });
+
+            const isArrayPR = comments.some(c =>
+              c.body.includes('<!-- array-stack-comment -->')
+            );
+
+            if (!isArrayPR) {
+              console.log('Not an Array PR, skipping');
+              return;
+            }
+
             const baseBranch = pr.base.ref;
             const trunk = ['main', 'master', 'develop'];
 
             if (trunk.includes(baseBranch)) {
-              console.log('✓ Base is trunk, no dependencies');
+              console.log('Base is trunk, no dependencies');
               return;
             }
 
@@ -55,18 +79,42 @@ jobs:
               const list = blockers.map(b => `#${b.number} (${b.title})`).join('\n  - ');
               core.setFailed(`Blocked by:\n  - ${list}\n\nMerge these PRs first (bottom to top).`);
             } else {
-              console.log('✓ All dependencies merged, ready to merge');
+              console.log('All dependencies merged, ready to merge');
             }
 
   recheck-dependents:
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request_target' && github.event.action == 'closed' && github.event.pull_request.merged == true
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true
+    permissions:
+      pull-requests: write
+      issues: read
     steps:
       - name: Trigger recheck of dependent PRs
         uses: actions/github-script@v7
         with:
           script: |
-            const mergedBranch = context.payload.pull_request.head.ref;
+            const pr = context.payload.pull_request;
+
+            // Check if this is an Array-managed PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number
+            });
+
+            const isArrayPR = comments.some(c =>
+              c.body.includes('<!-- array-stack-comment -->')
+            );
+
+            if (!isArrayPR) {
+              console.log('Not an Array PR, skipping');
+              return;
+            }
+
+            const mergedBranch = pr.head.ref;
 
             const { data: dependentPRs } = await github.rest.pulls.list({
               owner: context.repo.owner,
@@ -75,14 +123,12 @@ jobs:
               state: 'open'
             });
 
-            for (const pr of dependentPRs) {
-              console.log(`Re-checking PR #${pr.number}`);
-
-              // Update base to main since the branch will be deleted
+            for (const dependentPR of dependentPRs) {
+              console.log(`Re-checking PR #${dependentPR.number}`);
               await github.rest.pulls.update({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                pull_number: pr.number,
+                pull_number: dependentPR.number,
                 base: 'main'
               });
             }