diff --git a/.github/workflows/auto-response.yml b/.github/workflows/auto-response.yml
index c3aca216775..cc1601886a4 100644
--- a/.github/workflows/auto-response.yml
+++ b/.github/workflows/auto-response.yml
@@ -5,7 +5,7 @@ on:
     types: [opened, edited, labeled]
   issue_comment:
     types: [created]
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] maintainer-owned label automation; no untrusted checkout or code execution
     types: [labeled]
 
 env:
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 716f39ea24c..8e7d707a3d1 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -1,7 +1,7 @@
 name: Labeler
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] maintainer-owned triage workflow; no untrusted checkout or PR code execution
     types: [opened, synchronize, reopened]
   issues:
     types: [opened]