diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 50351e24b..5b2c597df 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -3,6 +3,9 @@ on:
   pull_request:
     types: [opened, synchronize]
   workflow_dispatch:
+  schedule:
+    # run every full hour (to still label PRs from forks)
+    - cron: '0 * * * *'
 
 jobs:
   labeler:
@@ -10,6 +13,8 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
+    # don't run on PRs from forks (token has no write permissions)
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     name: "Labeler"
     runs-on: ubuntu-latest
     steps: