diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 1e1163b..e6a5d3d 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -5,6 +5,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   changelog-check:
@@ -17,11 +18,16 @@ jobs:
       - name: Require Unreleased CHANGELOG.md additions or override label
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
 
-          if grep -q '"skip-changelog"' <<< "$LABELS"; then
+          # Pull request events can run out of order, so use the current labels
+          # rather than the labels captured when this event was created.
+          labels=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.labels[].name')
+          if grep -Fxq 'skip-changelog' <<< "$labels"; then
             echo "Found 'skip-changelog' label; no CHANGELOG.md entry required."
             exit 0
           fi
diff --git a/README.md b/README.md
index ce47120..9359650 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,8 @@ This is the default file for all Temporal OSS repos. Primarily we offer:
 `changelog.yml` verifies that a pull request adds to a `CHANGELOG.md` only
 within its Unreleased section. Repositories retain a small caller workflow so
 label changes can rerun the check and the `skip-changelog` override remains
-available.
+available. Callers grant `contents: read` for checkout and `pull-requests: read`
+so the shared workflow can read the pull request's current labels.
 
 
 ## Why do this