diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 00000000000..eb674ef1964
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,119 @@
+# Configuration for .github/workflows/labeler.yaml (https://github.com/actions/labeler).
+#
+# Labels are only ever added, never removed. The labels that satisfy the release-notes check
+# (`release-notes:not-required` and `category:internal`) are deliberately never applied here: whether
+# a change needs release notes is a human decision, and an added label would stay even if later
+# pushes made the PR user-facing.
+
+# If a PR would gain more than this many labels from the rules below, it gains none of them. This
+# keeps tree-wide refactors from collecting a label for every backend they happen to touch.
+changed-files-labels-limit: 3
+
+"backend: Adhoc":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/adhoc/**
+          - src/python/pants/backend/experimental/adhoc/**
+
+"backend: CC":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/cc/**
+          - src/python/pants/backend/experimental/cc/**
+
+"backend: Docker":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/docker/**
+          - src/python/pants/backend/experimental/docker/**
+
+"backend: Environments":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/core/environments/**
+
+"backend: Go":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/go/**
+          - src/python/pants/backend/experimental/go/**
+
+"backend: Helm":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/helm/**
+          - src/python/pants/backend/experimental/helm/**
+
+"backend: JavaScript":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/javascript/**
+          - src/python/pants/backend/typescript/**
+          - src/python/pants/backend/jsx/**
+          - src/python/pants/backend/tsx/**
+          - src/python/pants/backend/experimental/javascript/**
+          - src/python/pants/backend/experimental/typescript/**
+
+"backend: JVM":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/jvm/**
+          - src/python/pants/backend/java/**
+          - src/python/pants/backend/kotlin/**
+          - src/python/pants/backend/scala/**
+          - src/python/pants/backend/experimental/java/**
+          - src/python/pants/backend/experimental/kotlin/**
+          - src/python/pants/backend/experimental/scala/**
+
+"backend: OpenAPI":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/openapi/**
+          - src/python/pants/backend/experimental/openapi/**
+
+"backend: Protobuf":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/codegen/protobuf/**
+          - src/python/pants/backend/experimental/codegen/protobuf/**
+
+"backend: Python":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/python/**
+          - src/python/pants/backend/experimental/python/**
+
+"backend: Rust":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/rust/**
+          - src/python/pants/backend/experimental/rust/**
+
+"backend: Shell":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/shell/**
+
+"backend: Swift":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/swift/**
+          - src/python/pants/backend/experimental/swift/**
+
+"backend: Terraform":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/terraform/**
+          - src/python/pants/backend/experimental/terraform/**
+
+"backend: Thrift":
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/python/pants/backend/codegen/thrift/**
+          - src/python/pants/backend/experimental/codegen/thrift/**
+
+# Only when every changed file is user-facing documentation (release notes do not count).
+"category:documentation":
+  - changed-files:
+      - all-globs-to-all-files:
+          - "docs/docs/**"
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
new file mode 100644
index 00000000000..af44625e7d5
--- /dev/null
+++ b/.github/workflows/labeler.yaml
@@ -0,0 +1,30 @@
+# https://github.com/actions/labeler
+#
+# Adds labels to PRs based on the files they change. The rules are in .github/labeler.yml. Each run
+# looks at the PR's whole diff, so a push that touches a new area adds its label. The labeler keeps no
+# state between runs, so it also re-adds a matching label that someone removed by hand.
+
+name: Label pull requests
+on:
+  # `pull_request_target` rather than `pull_request`, so that PRs from forks get a token that can
+  # add labels. This is safe because nothing from the PR is checked out or run: the labeler lists
+  # the changed files through the API and reads .github/labeler.yml from the base branch.
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+permissions: {}
+
+jobs:
+  label:
+    name: Label from changed files
+    if: github.repository_owner == 'pantsbuild'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # read .github/labeler.yml
+      pull-requests: write  # add labels to the PR
+    steps:
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0