diff --git a/.github/workflows/dependabot_auto_label.yml b/.github/workflows/dependabot_auto_label.yml
deleted file mode 100644
index 9ad939e39..000000000
--- a/.github/workflows/dependabot_auto_label.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: 'Auto-label Dependabot PRs'
-
-on:
-  pull_request_target:
-    branches: [ master ]
-    types: [ opened, synchronize ]
-
-jobs:
-  auto-label:
-    name: 'Apply safe_to_test for Dependabot'
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Add safe_to_test label'
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const issue_number = context.payload.pull_request.number;
-
-            // Remove first so re-adding always fires a labeled event,
-            // which triggers the BrowserStack workflow.
-            try {
-              await github.rest.issues.removeLabel({
-                owner, repo, issue_number,
-                name: 'safe_to_test'
-              });
-            } catch (e) {
-              if (e.status !== 404) throw e;
-            }
-
-            await github.rest.issues.addLabels({
-              owner, repo, issue_number,
-              labels: ['safe_to_test']
-            });
diff --git a/.github/workflows/github_actions.yml b/.github/workflows/github_actions.yml
index 85600e868..6fd5bf34c 100644
--- a/.github/workflows/github_actions.yml
+++ b/.github/workflows/github_actions.yml
@@ -3,7 +3,7 @@ name: 'BrowserStack Test'
 on:
   pull_request_target:
     branches: [ master ]
-    types: [ labeled ]
+    types: [ opened, synchronize, reopened, labeled ]
 
 jobs:
   ubuntu-job:
@@ -12,12 +12,20 @@ jobs:
     concurrency:
       group: browserstack-${{ github.event.pull_request.number }}
       cancel-in-progress: true
-    if: github.event.label.name == 'safe_to_test'
+    # Auto-run for Dependabot; let humans opt in via the safe_to_test label.
+    # Require the triggering actor to also be Dependabot so commits pushed by
+    # anyone else fall back to the explicit safe_to_test opt-in.
+    if: >-
+      (github.event.pull_request.user.login == 'dependabot[bot]' &&
+       github.actor == 'dependabot[bot]' &&
+       github.event.action != 'labeled') ||
+      github.event.label.name == 'safe_to_test'
     env:
       GITACTIONS: true
     steps:
 
       - name: 'Remove safe_to_test label'
+        if: github.event.action == 'labeled'
         uses: actions/github-script@v8
         with:
           script: |