diff --git a/.github/workflows/cuda-gpu-ci.yml b/.github/workflows/cuda-gpu-ci.yml
index 5175993d02e7e..e8b0b83c3b9ed 100644
--- a/.github/workflows/cuda-gpu-ci.yml
+++ b/.github/workflows/cuda-gpu-ci.yml
@@ -1,31 +1,33 @@
 name: CUDA GPU
+
+# Only run this workflow when a Pull Request is labeled with the
+# 'CUDA CI' label.
 on:
-  workflow_dispatch:
-    inputs:
-      commit_hash:
-        description: Commit hash to test
-        required: true
+  pull_request:
+    types:
+      - labeled
 
-permissions: read-all
+# In order to remove the "CUDA CI" label we need to have write permissions for PRs
+permissions:
+  pull-requests: write
 
 jobs:
   tests:
+    if: contains(github.event.pull_request.labels.*.name, 'CUDA CI')
     runs-on:
       group: cuda-gpu-runner-group
     name: Run Array API unit tests
     steps:
+      - uses: actions-ecosystem/action-remove-labels@v1.3.0
+        with:
+          labels: CUDA CI
       - uses: actions/setup-python@v5
         with:
           # XXX: The 3.12.4 release of Python on GitHub Actions is corrupted:
           # https://github.com/actions/setup-python/issues/886
           python-version: '3.12.3'
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit_hash }}
-      - name: PRs associated with commit
-        run: |
-          echo "This commit belongs to PR(s):"
-          git ls-remote origin 'pull/*/head' | grep -F -f <(git rev-parse HEAD) | awk -F'/' '{print $3}'
+      - name: Checkout main repository
+        uses: actions/checkout@v4
       - name: Cache conda environment
         id: cache-conda
         uses: actions/cache@v4
@@ -41,6 +43,7 @@ jobs:
           conda activate sklearn
           pip install --verbose --no-build-isolation --config-settings editable-verbose=true --editable .
       - name: Run array API tests
+        id: tests
         run: |
           source "${HOME}/conda/etc/profile.d/conda.sh"
           conda activate sklearn
diff --git a/.github/workflows/update-lock-files.yml b/.github/workflows/update-lock-files.yml
index 143d8d9ea28f9..4f149f58cac07 100644
--- a/.github/workflows/update-lock-files.yml
+++ b/.github/workflows/update-lock-files.yml
@@ -6,9 +6,9 @@ on:
   schedule:
     - cron: '0 5 * * 1'
 
-# XXX Set the right permissions, per step??
-# Can we set read only at the global level here and then elevate to write for some steps?
-#permissions: read-all
+# In order to add the "CUDA CI" label we need to have write permissions for PRs
+permissions:
+  pull-requests: write
 
 jobs:
   update_lock_files:
@@ -68,7 +68,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh workflow run .github/workflows/cuda-gpu-ci.yml -f commit_hash=`git rev-parse HEAD`
+          gh pr edit ${{steps.cpr.outputs.pull-request-number}} --add-label "CUDA CI"
 
       - name: Check Pull Request
         if: steps.cpr.outputs.pull-request-number != ''