diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index b9a9c7e9dcbe..f0cb89e12817 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -159,6 +159,7 @@ jobs:
     needs: [ prepare, outpaths ]
     if: needs.prepare.outputs.targetSha
     permissions:
+      issues: write # needed to create *new* labels
       pull-requests: write
       statuses: write
     steps:
@@ -213,7 +214,7 @@ jobs:
         run: nix-build trusted/ci -A requestReviews
 
       - name: Labelling pull request
-        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        if: ${{ github.event_name == 'pull_request_target' }}
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
@@ -247,7 +248,7 @@ jobs:
           done < <(comm -13 before after)
 
       - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        if: ${{ github.event_name == 'pull_request_target' }}
         env:
           GH_TOKEN: ${{ github.token }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -279,7 +280,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Requesting maintainer reviews
-        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
+        if: ${{ steps.app-token.outputs.token }}
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 05fbb691d488..1fab6eba3977 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -10,13 +10,14 @@ on:
 
 permissions:
   contents: read
+  issues: write # needed to create *new* labels
   pull-requests: write
 
 jobs:
   labels:
     name: label-pr
     runs-on: ubuntu-24.04-arm
-    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
       - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         if: |