diff --git a/.github/workflows/autolabel.yaml b/.github/workflows/autolabel.yaml
index d0d2f6ee..095a549d 100644
--- a/.github/workflows/autolabel.yaml
+++ b/.github/workflows/autolabel.yaml
@@ -2,7 +2,10 @@
 name: Pull Request Labeler
 
 on:  # yamllint disable-line rule:truthy
-  pull_request:
+  # note: security risk from this action.  Do not add
+  # actions in here which need a checkout of the repo,
+  # and do not use any caching in here.
+  pull_request_target:
 
 jobs:
   autolabel: