diff --git a/.github/workflows/merge-queue.yml b/.github/workflows/merge-queue.yml
index 5e4c87d93..4ffbee898 100644
--- a/.github/workflows/merge-queue.yml
+++ b/.github/workflows/merge-queue.yml
@@ -24,6 +24,15 @@ permissions:
 
 jobs:
   queue:
+    # Only engage the merge-queue action when the `queue` label is the one
+    # being added (or on manual dispatch). Firing on any label makes the job
+    # run for routine labels like Dependabot's `dependencies`/`go`, where
+    # secrets.MERGE_QUEUE_TOKEN is withheld from the run and the action fails
+    # with "Input required and not supplied: token". Guarding on the label
+    # name skips those events cleanly instead of failing on the absent token.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event.label.name == 'queue'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2