diff --git a/.github/workflows/dependabot_auto_label.yml b/.github/workflows/dependabot_auto_label.yml
new file mode 100644
index 000000000..9ad939e39
--- /dev/null
+++ b/.github/workflows/dependabot_auto_label.yml
@@ -0,0 +1,35 @@
+name: 'Auto-label Dependabot PRs'
+
+on:
+  pull_request_target:
+    branches: [ master ]
+    types: [ opened, synchronize ]
+
+jobs:
+  auto-label:
+    name: 'Apply safe_to_test for Dependabot'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Add safe_to_test label'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+
+            // Remove first so re-adding always fires a labeled event,
+            // which triggers the BrowserStack workflow.
+            try {
+              await github.rest.issues.removeLabel({
+                owner, repo, issue_number,
+                name: 'safe_to_test'
+              });
+            } catch (e) {
+              if (e.status !== 404) throw e;
+            }
+
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number,
+              labels: ['safe_to_test']
+            });
diff --git a/.github/workflows/github_actions.yml b/.github/workflows/github_actions.yml
index d917e8ee1..85600e868 100644
--- a/.github/workflows/github_actions.yml
+++ b/.github/workflows/github_actions.yml
@@ -3,7 +3,7 @@ name: 'BrowserStack Test'
 on:
   pull_request_target:
     branches: [ master ]
-    types: [ labeled, opened, synchronize ]
+    types: [ labeled ]
 
 jobs:
   ubuntu-job:
@@ -12,15 +12,12 @@ jobs:
     concurrency:
       group: browserstack-${{ github.event.pull_request.number }}
       cancel-in-progress: true
-    if: |
-      github.event.label.name == 'safe_to_test' ||
-      github.event.pull_request.user.login == 'dependabot[bot]'
+    if: github.event.label.name == 'safe_to_test'
     env:
       GITACTIONS: true
     steps:
 
       - name: 'Remove safe_to_test label'
-        if: github.event.label.name == 'safe_to_test'
         uses: actions/github-script@v8
         with:
           script: |
@@ -79,4 +76,4 @@ jobs:
       - name: 'BrowserStackLocal Stop'  # Terminating the BrowserStackLocal tunnel connection
         uses: browserstack/github-actions/setup-local@master
         with:
-          local-testing: stop
\ No newline at end of file
+          local-testing: stop