diff --git a/.github/labeler.yml b/.github/labeler.yml
index 940494098..77976d12f 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -2,79 +2,79 @@
 "domain:Access":
 - changed-files:
   - any-glob-to-any-file:
-    - "internal/cmd/alb/*"
-    - "internal/cmd/albwaf/*"
-    - "internal/cmd/cdn/*"
-    - "internal/cmd/certificates/*"
-    - "internal/cmd/loadbalancer/*"
-    - "internal/cmd/vpn/*"
+    - "internal/cmd/alb/**"
+    - "internal/cmd/albwaf/**"
+    - "internal/cmd/cdn/**"
+    - "internal/cmd/certificates/**"
+    - "internal/cmd/loadbalancer/**"
+    - "internal/cmd/vpn/**"
 # runtimes
 "domain:Runtimes":
 - changed-files:
   - any-glob-to-any-file:
-    - "internal/cmd/ske/*"
-    - "internal/cmd/scf/*"
-    - "internal/cmd/edge/*"
+    - "internal/cmd/ske/**"
+    - "internal/cmd/scf/**"
+    - "internal/cmd/edge/**"
 # support
 # no support domain sdk modules available yet
 # central services
 "domain:CentralServices":
 - changed-files:
   - any-glob-to-any-file:
-    - "internal/cmd/dns/*"
-    - "internal/cmd/git/*"
-    - "internal/cmd/intake/*"
-    - "internal/cmd/kms/*"
-    - "internal/cmd/kms/*"
-    - "internal/cmd/logs/*"
-    - "internal/cmd/modelserving/*"
-    - "internal/cmd/observability/*"
-    - "internal/cmd/rabbitmq/*"
-    - "internal/cmd/redis/*"
-    - "internal/cmd/opensearch/*"
-    - "internal/cmd/logme/*"
-    - "internal/cmd/telemetryrouter/*"
-    - "internal/cmd/telemetrylink/*"
-    - "internal/cmd/secretsmanager/*"
-    - "internal/cmd/dremio/*"
-    - "internal/cmd/modelexperiments/*"
-    - "internal/cmd/ufw/*"
-    - "internal/cmd/workflows/*"
-    - "internal/cmd/valkey/*"
+    - "internal/cmd/dns/**"
+    - "internal/cmd/git/**"
+    - "internal/cmd/intake/**"
+    - "internal/cmd/kms/**"
+    - "internal/cmd/kms/**"
+    - "internal/cmd/logs/**"
+    - "internal/cmd/modelserving/**"
+    - "internal/cmd/observability/**"
+    - "internal/cmd/rabbitmq/**"
+    - "internal/cmd/redis/**"
+    - "internal/cmd/opensearch/**"
+    - "internal/cmd/logme/**"
+    - "internal/cmd/telemetryrouter/**"
+    - "internal/cmd/telemetrylink/**"
+    - "internal/cmd/secretsmanager/**"
+    - "internal/cmd/dremio/**"
+    - "internal/cmd/modelexperiments/**"
+    - "internal/cmd/ufw/**"
+    - "internal/cmd/workflows/**"
+    - "internal/cmd/valkey/**"
 # databases
 "domain:Databases":
 - changed-files:
   - any-glob-to-any-file:
-    - "internal/cmd/mongodbflex/*"
-    - "internal/cmd/mariadb/*"
-    - "internal/cmd/sqlserverflex/*"
-    - "internal/cmd/postgresflex/*"
+    - "internal/cmd/mongodbflex/**"
+    - "internal/cmd/mariadb/**"
+    - "internal/cmd/sqlserverflex/**"
+    - "internal/cmd/postgresflex/**"
 # IaaS
 "domain:IaaS":
 - changed-files:
   - any-glob-to-any-file:
-    - "internal/cmd/network-area/*"
-    - "internal/cmd/network/*"
-    - "internal/cmd/network-interface/*"
-    - "internal/cmd/public-ip/*"
-    - "internal/cmd/server/*"
-    - "internal/cmd/volume/*"
-    - "internal/cmd/security-group/*"
-    - "internal/cmd/image/*"
-    - "internal/cmd/objectstorage/*"
-    - "internal/cmd/runcommand/*"
-    - "internal/cmd/serverbackup/*"
-    - "internal/cmd/serverupdate/*"
-    - "internal/cmd/sfs/*"
-    - "internal/cmd/automation/*"
+    - "internal/cmd/network-area/**"
+    - "internal/cmd/network/**"
+    - "internal/cmd/network-interface/**"
+    - "internal/cmd/public-ip/**"
+    - "internal/cmd/server/**"
+    - "internal/cmd/volume/**"
+    - "internal/cmd/security-group/**"
+    - "internal/cmd/image/**"
+    - "internal/cmd/objectstorage/**"
+    - "internal/cmd/runcommand/**"
+    - "internal/cmd/serverbackup/**"
+    - "internal/cmd/serverupdate/**"
+    - "internal/cmd/sfs/**"
+    - "internal/cmd/automation/**"
 # core platform
 "domain:CorePlatform":
 - changed-files:
   - any-glob-to-any-file:
-    - "internal/cmd/auditlog/*"
-    - "internal/cmd/authorization/*"
-    - "internal/cmd/organization/*"
-    - "internal/cmd/project/*"
-    - "internal/cmd/serviceaccount/*"
-    - "internal/cmd/serviceenablement/*"
-    - "internal/cmd/cost/*"
+    - "internal/cmd/auditlog/**"
+    - "internal/cmd/authorization/**"
+    - "internal/cmd/organization/**"
+    - "internal/cmd/project/**"
+    - "internal/cmd/serviceaccount/**"
+    - "internal/cmd/serviceenablement/**"
+    - "internal/cmd/cost/**"
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 4c35df98c..1d97ae6f9 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -8,13 +8,14 @@ on:
     - cron: '0 * * * *'
 
 jobs:
-  labeler:
+  # this job runs when the workflow was triggered by the 'pull_request' event
+  pr-labeler:
     permissions:
       contents: read
       pull-requests: write
       issues: write
     # don't run on PRs from forks (token has no write permissions)
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     name: "Labeler"
     runs-on: ubuntu-latest
     steps:
@@ -22,3 +23,34 @@ jobs:
         uses: actions/labeler@v7
         with:
           sync-labels: false
+  
+  # This job runs when the workflow was triggered by the 'workflow_dispatch' or the 'schedule' event.
+  # This is neccessary because for PRs from forks the default short-lived GitHub token has no write permissions
+  # and can not add labels to the PR therefore. This means we have to label all PRs from forks using the 'schedule' event.
+  scheduled-labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    # don't run on PRs from forks (token has no write permissions)
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    name: "Label all open PRs"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch open PR numbers
+        id: fetch-prs
+        run: |
+          {
+            echo 'numbers<<EOF'
+            gh pr list --repo ${{ github.repository }} --state open --limit 500 --json number --jq '.[].number'
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Labeler action
+        if: ${{ steps.fetch-prs.outputs.numbers != '' }}
+        uses: actions/labeler@v7
+        with:
+          sync-labels: false
+          pr-number: ${{ steps.fetch-prs.outputs.numbers }}