diff --git a/.github/labeler.yml b/.github/labeler.yml
index 42e52e553f..4298887481 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,4 +1,10 @@
 # Any python files modifed but no test files modified
 add-test-cases:
-- any: ['frappe/**/*.py']
-  all: ['!frappe/**/test*.py']
+- all:
+  - changed-files:
+    - any-glob-to-any-file: 'frappe/**/*.py'
+    - all-globs-to-all-files: '!frappe/**/test*.py'
+
+# Add 'release' label to any PR that is opened against the `main` branch
+release:
+ - base-branch: ['^version-\d+$']
diff --git a/.github/workflows/labeller.yml b/.github/workflows/labeller.yml
index a43d1343f9..17dc381d8f 100644
--- a/.github/workflows/labeller.yml
+++ b/.github/workflows/labeller.yml
@@ -5,8 +5,14 @@ on:
 
 jobs:
   triage:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
+    - name: Clone
+      uses: actions/checkout@v3
+
     - uses: actions/labeler@v5
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"