diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 8e241d5..10e1de3 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -36,6 +36,12 @@ env:
   # loud. Silence is the failure mode this workflow exists to fix, so a sweep
   # that quietly does nothing must still leave a mark.
   STALE_AFTER_HOURS: 12
+  # Neither job checks out the repo, so gh has no git remote to infer from.
+  # Steps that pass a PR URL resolve the repo from the argument; `gh label
+  # create` takes no URL, so it fell back to git and exited 1 -- on every
+  # eligible PR the fleet ever saw. Set once here rather than per step: the
+  # next gh call added to either job is then correct by default.
+  GH_REPO: ${{ github.repository }}
 
 jobs:
   classify:
@@ -144,7 +150,6 @@ jobs:
       - name: Collect open Dependabot PRs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
         run: |
           gh pr list --author "app/dependabot" --state open --limit 100 \
             --json number,url,title,labels,autoMergeRequest,mergeStateStatus,statusCheckRollup,createdAt \
@@ -251,7 +256,6 @@ jobs:
       - name: Arm or land
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
         run: |
           acted=0
           while IFS=$'\t' read -r n act _rest; do