diff --git a/.github/workflows/fullsend.yaml b/.github/workflows/fullsend.yaml
index d35d6ab..befcb5a 100644
--- a/.github/workflows/fullsend.yaml
+++ b/.github/workflows/fullsend.yaml
@@ -21,12 +21,6 @@
 # changes to enrolled repos.
 name: fullsend
 
-permissions:
-  actions: write
-  id-token: write
-  contents: read
-  pull-requests: read
-
 on:
   issues:
     types: [opened, edited, labeled]
@@ -37,16 +31,32 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions: {}
+
 jobs:
   dispatch:
     concurrency:
-      group: fullsend-dispatch-${{ github.event.issue.number || github.event.pull_request.number }}
+      # Label-derived suffix for labeled events so routing labels
+      # get isolated concurrency slots (#2452).
+      group: >-
+        fullsend-dispatch-${{ github.event.issue.number || github.event.pull_request.number }}-${{
+          github.event.action == 'labeled' && format('label-{0}', github.event.label.name) || 'dispatch'
+        }}
       cancel-in-progress: false
     if: >-
       (github.event_name != 'pull_request_target' && github.event_name != 'pull_request_review'
        || github.event.pull_request.head.ref != 'fullsend/scaffold-install')
       && (github.event_name != 'issue_comment'
        || github.event.comment.user.type != 'Bot')
+      && (
+        github.event.action != 'labeled'
+        || startsWith(github.event.label.name, 'ready-')
+      )
+    permissions:
+      actions: write
+      id-token: write
+      contents: read
+      pull-requests: read
     uses: fullsend-ai/.fullsend/.github/workflows/dispatch.yml@main
     with:
       event_action: ${{ github.event.action }}