diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 0000000000..d1a7c744ed
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,5 @@
+"ciflow/docker":
+  globs:
+    - .ci/docker/**
+    - .github/workflows/docker-build.yml
+  draft: false
diff --git a/.github/pytorch-probot.yml b/.github/pytorch-probot.yml
index 6d0e8803ef..606596e520 100644
--- a/.github/pytorch-probot.yml
+++ b/.github/pytorch-probot.yml
@@ -1 +1,4 @@
 tracking_issue: 1896
+ciflow_push_tags:
+- ciflow/docker
+labeler_config: labeler.yml
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index ead908e909..b95f90d298 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -2,16 +2,16 @@ name: Docker Build
 
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - .ci/docker/**
-      - .github/workflows/docker-builds.yml
   push:
     branches:
       - main
+    # A fork PR gets no OIDC token to push to ECR, so a PR opts in with the
+    # ciflow/docker label instead, which pushes this tag from the base repo.
+    tags:
+      - ciflow/docker/*
     paths:
       - .ci/docker/**
-      - .github/workflows/docker-builds.yml
+      - .github/workflows/docker-build.yml
 
 jobs:
   docker-build: