diff --git a/.github/workflows/community-label.yml b/.github/workflows/community-label.yml
index bbaeb33a..3740e983 100644
--- a/.github/workflows/community-label.yml
+++ b/.github/workflows/community-label.yml
@@ -2,6 +2,8 @@ name: Add Community Label
 
 on:
   pull_request_target:
+    # NOTE: pull_request_target is required to have write permissions to add labels on PRs from forks.
+    # This workflow must not be modified to check out or execute untrusted PR code, as it runs with base repo permissions.
     types: [opened]
 
 jobs: