diff --git a/.github/workflows/label-external-contributions.yaml b/.github/workflows/label-external-contributions.yaml
new file mode 100644
index 000000000..de9f2439c
--- /dev/null
+++ b/.github/workflows/label-external-contributions.yaml
@@ -0,0 +1,38 @@
+name: Workflow to label external contributions
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add external-contribution label
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
+          REPO_FULL_NAME=$(jq --raw-output .repository.full_name "$GITHUB_EVENT_PATH")
+          IS_FORK=$(jq --raw-output .pull_request.head.repo.fork "$GITHUB_EVENT_PATH")
+
+          if [[ "$IS_FORK" == "true" ]]; then
+              echo "This PR is created from a fork."
+              HTTP_STATUS=$(curl -o /dev/null -s -w "%{http_code}\n" \
+              -X POST \
+              -H "Authorization: Bearer $GITHUB_TOKEN" \
+              -H "Accept: application/vnd.github.v3+json" \
+              "https://api.github.com/repos/$REPO_FULL_NAME/issues/$PR_NUMBER/labels" \
+              -d '{"labels": ["external-contribution"]}')
+
+              if [[ $HTTP_STATUS -ge 300 ]]; then
+                  echo "Failed to add label to PR, exiting."
+                  exit 1
+              fi
+          else
+              echo "This PR is not created from a fork."
+          fi