diff --git a/.github/workflows/CI_docstring_labeler.yml b/.github/workflows/CI_docstring_labeler.yml
index 8fd6b19fed..ea507e52d1 100644
--- a/.github/workflows/CI_docstring_labeler.yml
+++ b/.github/workflows/CI_docstring_labeler.yml
@@ -38,6 +38,9 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
           # This must be set to correctly checkout a fork
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          # Safe because the script is copied from the trusted base before this checkout;
+          # fork files are only read as data, never executed.
+          allow-unsafe-pr-checkout: true
 
       - name: Get docstrings
         id: head-docstrings