diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index 049a825..26acd7b 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -4,10 +4,14 @@
 name: PR Labeler
 
 on:
-  pull_request:
+  pull_request_target:
     types: [ opened ]
+    # Do NOT check out, build, or run untrusted code from the pull request with this event.
+
+permissions:
+  contents: read
+  pull-requests: write
 
-permissions: write-all
 jobs:
   pr-labeler:
     runs-on: ubuntu-latest