diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index f9c5ac7..d28cf7d 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -1,11 +1,13 @@
 ---
 name: "Pull Request Labeler"
-on: [pull_request]
+on:
+  - pull_request_target
 
 jobs:
   triage:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@v5
-        with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"