diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 05c1e3eb5f..736b459b07 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -11,7 +11,7 @@ name: Claude Review
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, labeled]
   # Strangely enough you have to use issue_comment to react to regular comments on PRs.
   # See https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_comment-use-issue_comment.
   issue_comment:
@@ -33,8 +33,11 @@ jobs:
     if: |
       github.repository_owner == 'systemd' &&
       ((github.event_name == 'pull_request_target' &&
-        contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.pull_request.author_association) &&
-        github.event.pull_request.user.login != 'YHNdnzj') ||
+        (github.event.action == 'labeled' && github.event.label.name == 'claude-review' && github.event.sender.login != 'github-actions[bot]' ||
+         github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'claude-review') ||
+         github.event.action == 'opened' &&
+         contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.pull_request.author_association) &&
+         github.event.pull_request.user.login != 'YHNdnzj')) ||
        (github.event_name == 'issue_comment' &&
         github.event.issue.pull_request &&
         contains(github.event.comment.body, '@claude review') &&
@@ -56,6 +59,12 @@ jobs:
       comment_id: ${{ steps.tracking.outputs.comment_id }}
 
     steps:
+      - name: Auto-add claude-review label for trusted contributors
+        if: github.event_name == 'pull_request_target' && github.event.action == 'opened'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr edit --repo "${{ github.repository }}" "$PR_NUMBER" --add-label claude-review
+
       - name: Resolve PR metadata
         id: pr
         env:
@@ -195,10 +204,10 @@ jobs:
             --max-turns 100
             --allowedTools "
                 Read,LS,Grep,Glob,Task,TaskStop,
-                Bash(cat:*),Bash(test:*),Bash(printf:*),Bash(jq:*),Bash(head:*),Bash(tail:*),
-                Bash(git:*),Bash(grep:*),Bash(find:*),Bash(ls:*),Bash(wc:*),
-                Bash(gh:api *),
-                Bash(diff:*),Bash(sed:*),Bash(awk:*),Bash(sort:*),Bash(uniq:*),
+                Bash(cat *),Bash(test *),Bash(printf *),Bash(jq *),Bash(head *),Bash(tail *),
+                Bash(git *),Bash(grep *),Bash(find *),Bash(ls *),Bash(wc *),
+                Bash(gh api *),
+                Bash(diff *),Bash(sed *),Bash(awk *),Bash(sort *),Bash(uniq *),
                 "
             --json-schema '${{ env.REVIEW_SCHEMA }}'
           prompt: |