diff --git a/routers/web/repo/actions/actions.go b/routers/web/repo/actions/actions.go
index 90d3226f2d..ff3b16159b 100644
--- a/routers/web/repo/actions/actions.go
+++ b/routers/web/repo/actions/actions.go
@@ -95,6 +95,8 @@ func List(ctx *context.Context) {
 			allRunnerLabels.AddMultiple(r.AgentLabels...)
 		}
 
+		canRun := ctx.Repo.CanWrite(unit.TypeActions)
+
 		workflows = make([]Workflow, 0, len(entries))
 		for _, entry := range entries {
 			workflow := Workflow{Entry: *entry}
@@ -146,7 +148,7 @@ func List(ctx *context.Context) {
 			}
 			workflows = append(workflows, workflow)
 
-			if workflow.Entry.Name() == curWorkflow {
+			if canRun && workflow.Entry.Name() == curWorkflow {
 				config := wf.WorkflowDispatchConfig()
 				if config != nil {
 					keys := util.KeysOfMap(config.Inputs)
diff --git a/tests/e2e/actions.test.e2e.js b/tests/e2e/actions.test.e2e.js
index d7ca75bfc6..dcbd123e0b 100644
--- a/tests/e2e/actions.test.e2e.js
+++ b/tests/e2e/actions.test.e2e.js
@@ -6,6 +6,8 @@ test.beforeAll(async ({browser}, workerInfo) => {
   await login_user(browser, workerInfo, 'user2');
 });
 
+const workflow_trigger_notification_text = 'This workflow has a workflow_dispatch event trigger.';
+
 test('Test workflow dispatch present', async ({browser}, workerInfo) => {
   const context = await load_logged_in_context(browser, workerInfo, 'user2');
   /** @type {import('@playwright/test').Page} */
@@ -13,7 +15,7 @@ test('Test workflow dispatch present', async ({browser}, workerInfo) => {
 
   await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
 
-  await expect(page.getByText('This workflow has a workflow_dispatch event trigger.')).toBeVisible();
+  await expect(page.getByText(workflow_trigger_notification_text)).toBeVisible();
 
   const run_workflow_btn = page.locator('#workflow_dispatch_dropdown>button');
   await expect(run_workflow_btn).toBeVisible();
@@ -72,3 +74,10 @@ test('Test workflow dispatch success', async ({browser}, workerInfo) => {
 
   await expect(page.locator('.run-list>:first-child .run-list-meta', {hasText: 'now'})).toBeVisible();
 });
+
+test('Test workflow dispatch box not available for unauthenticated users', async ({page}) => {
+  await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
+  await page.waitForLoadState('networkidle');
+
+  await expect(page.locator('body')).not.toContainText(workflow_trigger_notification_text);
+});