diff --git a/.github/workflows/update-codeql-version.yml b/.github/workflows/update-codeql-version.yml
index a219e036..4dbc2c89 100644
--- a/.github/workflows/update-codeql-version.yml
+++ b/.github/workflows/update-codeql-version.yml
@@ -187,6 +187,36 @@ jobs:
           app-id: ${{ secrets.SECLABS_APP_ID }}
           private-key: ${{ secrets.SECLABS_APP_KEY }}
 
+      - name: Compute PR labels
+        id: pr_labels
+        run: |
+          set -euo pipefail
+          {
+            echo "list<<EOF"
+            echo "version"
+            echo "codeql-cli-v${{ steps.version.outputs.version }}"
+            if [[ -n "${{ steps.release_bump.outputs.bump }}" ]]; then
+              echo "release-v${{ steps.release_version.outputs.version }}"
+            fi
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Ensure version labels exist
+        env:
+          GH_TOKEN: ${{ steps.get_workflow_token.outputs.token }}
+        run: |
+          set -euo pipefail
+          # `version` already exists in the repo; only the version-specific
+          # labels below need to be created on demand. `gh label create --force`
+          # is idempotent, so re-running this workflow for the same version is
+          # safe.
+          while IFS= read -r LABEL; do
+            if [[ -z "$LABEL" || "$LABEL" == "version" ]]; then
+              continue
+            fi
+            gh label create "$LABEL" --color ededed --force
+          done <<< "${{ steps.pr_labels.outputs.list }}"
+
       - name: Build PR title and body
         id: pr_meta
         run: |
@@ -260,5 +290,5 @@ jobs:
           commit-message: ${{ steps.pr_meta.outputs.title }}
           body-path: "${{ runner.temp }}/pr-body.md"
           branch: "chore/update-codeql-cli-${{ steps.version.outputs.version }}"
-          labels: "version"
+          labels: ${{ steps.pr_labels.outputs.list }}
           delete-branch: true
diff --git a/.github/workflows/update-release.yml b/.github/workflows/update-release.yml
index 5de4d2ee..be8affda 100644
--- a/.github/workflows/update-release.yml
+++ b/.github/workflows/update-release.yml
@@ -59,6 +59,14 @@ jobs:
             ghcr.io/42bytelabs/patch-release-me@sha256:d9d7abe7051855d0c395fec99d931acc002fb6b299ca16b8123e2c8ef0c7e750 \
             --disable-banner bump -m ${{ inputs.mode }}
 
+      - name: Determine new release version
+        id: release_version
+        run: |
+          set -euo pipefail
+          NEW_VERSION="$(grep -E '^version:' .release.yml | head -1 | sed -E 's/^version:[[:space:]]*"?([^"[:space:]]+)"?/\1/')"
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Release version bumped to ${NEW_VERSION}"
+
       - name: Set release prerelease flag
         run: |
           set -euo pipefail
@@ -75,6 +83,15 @@ jobs:
             sed -i -E "/^version:/a prerelease: ${{ inputs.prerelease }}" .release.yml
           fi
 
+      - name: Ensure version label exists
+        env:
+          GH_TOKEN: ${{ steps.get_workflow_token.outputs.token }}
+        run: |
+          set -euo pipefail
+          # `gh label create --force` is idempotent, so re-running this
+          # workflow for the same release version is safe.
+          gh label create "release-v${{ steps.release_version.outputs.version }}" --color ededed --force
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
@@ -90,5 +107,7 @@ jobs:
             Merging this PR triggers `publish.yml`'s real batch publish. Its `summary`
             job will create the matching GitHub Release as a **${{ inputs.prerelease && 'pre-release' || 'full release' }}**.
           branch: "auto-patch-release"
-          labels: "version"
+          labels: |
+            version
+            release-v${{ steps.release_version.outputs.version }}
           delete-branch: true