diff --git a/.github/labeler.yml b/.github/labeler.yml
index 7711d6bb2..6e22f064b 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -2,74 +2,74 @@
 "domain:Access":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/alb/*"
-    - "stackit/internal/services/albwaf/*"
-    - "stackit/internal/services/cdn/*"
-    - "stackit/internal/services/certificates/*"
-    - "stackit/internal/services/loadbalancer/*"
-    - "stackit/internal/services/vpn/*"
+    - "stackit/internal/services/alb/**"
+    - "stackit/internal/services/albwaf/**"
+    - "stackit/internal/services/cdn/**"
+    - "stackit/internal/services/certificates/**"
+    - "stackit/internal/services/loadbalancer/**"
+    - "stackit/internal/services/vpn/**"
 # kubernetes
 "domain:Kubernetes":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/ske/*"
-    - "stackit/internal/services/edgecloud/*"
+    - "stackit/internal/services/ske/**"
+    - "stackit/internal/services/edgecloud/**"
 # serverless
 "domain:Serverless":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/scf/*"
+    - "stackit/internal/services/scf/**"
 # support
 # no support domain sdk modules available yet
 # central services
 "domain:CentralServices":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/dns/*"
-    - "stackit/internal/services/git/*"
-    - "stackit/internal/services/intake/*"
-    - "stackit/internal/services/kms/*"
-    - "stackit/internal/services/logs/*"
-    - "stackit/internal/services/modelserving/*"
-    - "stackit/internal/services/observability/*"
-    - "stackit/internal/services/rabbitmq/*"
-    - "stackit/internal/services/redis/*"
-    - "stackit/internal/services/opensearch/*"
-    - "stackit/internal/services/logme/*"
-    - "stackit/internal/services/telemetryrouter/*"
-    - "stackit/internal/services/telemetrylink/*"
-    - "stackit/internal/services/secretsmanager/*"
-    - "stackit/internal/services/dremio/*"
-    - "stackit/internal/services/modelexperiments/*"
-    - "stackit/internal/services/ufw/*"
-    - "stackit/internal/services/workflows/*"
-    - "stackit/internal/services/valkey/*"
+    - "stackit/internal/services/dns/**"
+    - "stackit/internal/services/git/**"
+    - "stackit/internal/services/intake/**"
+    - "stackit/internal/services/kms/**"
+    - "stackit/internal/services/logs/**"
+    - "stackit/internal/services/modelserving/**"
+    - "stackit/internal/services/observability/**"
+    - "stackit/internal/services/rabbitmq/**"
+    - "stackit/internal/services/redis/**"
+    - "stackit/internal/services/opensearch/**"
+    - "stackit/internal/services/logme/**"
+    - "stackit/internal/services/telemetryrouter/**"
+    - "stackit/internal/services/telemetrylink/**"
+    - "stackit/internal/services/secretsmanager/**"
+    - "stackit/internal/services/dremio/**"
+    - "stackit/internal/services/modelexperiments/**"
+    - "stackit/internal/services/ufw/**"
+    - "stackit/internal/services/workflows/**"
+    - "stackit/internal/services/valkey/**"
 # databases
 "domain:Databases":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/mongodbflex/*"
-    - "stackit/internal/services/mariadb/*"
-    - "stackit/internal/services/sqlserverflex/*"
-    - "stackit/internal/services/postgresflex/*"
+    - "stackit/internal/services/mongodbflex/**"
+    - "stackit/internal/services/mariadb/**"
+    - "stackit/internal/services/sqlserverflex/**"
+    - "stackit/internal/services/postgresflex/**"
 # IaaS
 "domain:IaaS":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/iaas/*"
-    - "stackit/internal/services/objectstorage/*"
-    - "stackit/internal/services/runcommand/*"
-    - "stackit/internal/services/serverbackup/*"
-    - "stackit/internal/services/serverupdate/*"
-    - "stackit/internal/services/sfs/*"
-    - "stackit/internal/services/automation/*"
+    - "stackit/internal/services/iaas/**"
+    - "stackit/internal/services/objectstorage/**"
+    - "stackit/internal/services/runcommand/**"
+    - "stackit/internal/services/serverbackup/**"
+    - "stackit/internal/services/serverupdate/**"
+    - "stackit/internal/services/sfs/**"
+    - "stackit/internal/services/automation/**"
 # core platform
 "domain:CorePlatform":
 - changed-files:
   - any-glob-to-any-file:
-    - "stackit/internal/services/auditlog/*"
-    - "stackit/internal/services/authorization/*"
-    - "stackit/internal/services/iam/*"
-    - "stackit/internal/services/resourcemanager/*"
-    - "stackit/internal/services/serviceaccount/*"
-    - "stackit/internal/services/serviceenablement/*"
+    - "stackit/internal/services/auditlog/**"
+    - "stackit/internal/services/authorization/**"
+    - "stackit/internal/services/iam/**"
+    - "stackit/internal/services/resourcemanager/**"
+    - "stackit/internal/services/serviceaccount/**"
+    - "stackit/internal/services/serviceenablement/**"
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 4c35df98c..b81772964 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -8,13 +8,14 @@ on:
     - cron: '0 * * * *'
 
 jobs:
-  labeler:
+  # this job runs when the workflow was triggered by the 'pull_request' event
+  pr-labeler:
     permissions:
       contents: read
       pull-requests: write
       issues: write
     # don't run on PRs from forks (token has no write permissions)
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     name: "Labeler"
     runs-on: ubuntu-latest
     steps:
@@ -22,3 +23,33 @@ jobs:
         uses: actions/labeler@v7
         with:
           sync-labels: false
+  
+  # This job runs when the workflow was triggered by the 'workflow_dispatch' or the 'schedule' event.
+  # This is neccessary because for PRs from forks the default short-lived GitHub token has no write permissions
+  # and can not add labels to the PR therefore. This means we have to label all PRs from forks using the 'schedule' event.
+  scheduled-labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    name: "Label all open PRs"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch open PR numbers
+        id: fetch-prs
+        run: |
+          {
+            echo 'numbers<<EOF'
+            gh pr list --repo ${{ github.repository }} --state open --limit 500 --json number --jq '.[].number'
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Labeler action
+        if: ${{ steps.fetch-prs.outputs.numbers != '' }}
+        uses: actions/labeler@v7
+        with:
+          sync-labels: false
+          pr-number: ${{ steps.fetch-prs.outputs.numbers }}