diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
new file mode 100644
index 0000000..23a1693
--- /dev/null
+++ b/.github/workflows/pr-labeler.yaml
@@ -0,0 +1,26 @@
+name: PR Labeler
+
+on:
+  # zizmor: ignore[dangerous-triggers] pull_request_target is required so
+  # autolabeler gets write access on PRs from forks; this workflow never
+  # checks out or executes code from the PR, only calls the labels API.
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  autolabel:
+    name: Autolabel PR
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write  # to autolabel PRs
+    steps:
+      - uses: release-drafter/release-drafter/autolabeler@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml
index ea1f7ab..f572f79 100644
--- a/.github/workflows/release-drafter.yaml
+++ b/.github/workflows/release-drafter.yaml
@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-  pull_request:
-    types: [opened, reopened, synchronize]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -20,12 +18,7 @@ jobs:
     timeout-minutes: 5
     permissions:
       contents: write  # to create/update the draft release
-      pull-requests: write  # to autolabel PRs
     steps:
-      - if: github.event_name == 'pull_request'
-        uses: release-drafter/release-drafter/autolabeler@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}