diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b40f53bfd8..06241e0d01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: ForgeRock Pull Request CI
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
 
 env:
   NX_CLOUD_ENCRYPTION_KEY: ${{ secrets.NX_CLOUD_ENCRYPTION_KEY }}
@@ -14,6 +15,18 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  block-merge-label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if "Do not merge" label present
+        env:
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          if echo "$LABELS" | tr '[:upper:]' '[:lower:]' | grep -q '"do not merge"'; then
+            echo "::error::Merge blocked: PR is labeled 'do not merge'."
+            exit 1
+          fi
+
   pr:
     if: ${{github.event.pull_request.head.repo.full_name == github.repository}}
     runs-on: ubuntu-latest