diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index bff960f..2753e79 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -66,7 +66,7 @@ jobs:
       - name: Label pull-request
         # HACK: skip if contributor does not have write permissions (forks)
         if: github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           sync-labels: true
diff --git a/doc/changelog.d/129.maintenance.md b/doc/changelog.d/129.maintenance.md
new file mode 100644
index 0000000..5520a66
--- /dev/null
+++ b/doc/changelog.d/129.maintenance.md
@@ -0,0 +1 @@
+Bump actions/labeler from 6.2.0 to 7.0.0 in the actions group