diff --git a/.github/labeler.yml b/.github/labeler.yml
index 8d4e43d3..1e39ac8f 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -12,52 +12,68 @@
 
 # Rust Soroban contracts — the canonical on-chain API surface.
 api:
-  - "campaign/**"
-  - "common/**"
-  - "token-bridge/**"
-  - "crates/contracts/core/**"
-  - "crates/contracts/batch-donor/**"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "campaign/**"
+      - "common/**"
+      - "token-bridge/**"
+      - "crates/contracts/core/**"
+      - "crates/contracts/batch-donor/**"
 
 # Native CLI tooling (`cargo run -p orbitchain-tools -- …`).
 cli:
-  - "crates/tools/**"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "crates/tools/**"
 
 # Frontend / mobile-wallet surfaces (Playwright + wallet integration).
 frontend:
-  - "wallet_connect.html"
-  - "wallet_connect.js"
-  - "tests/e2e/**"
-  - "playwright.config.js"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "wallet_connect.html"
+      - "wallet_connect.js"
+      - "tests/e2e/**"
+      - "playwright.config.js"
 
 # CI / build infrastructure.
 ci:
-  - ".github/workflows/**"
-  - ".github/*.md"
-  - ".github/ISSUE_TEMPLATE/**"
-  - ".cargo/**"
-  - "rust-toolchain.toml"
-  - "Cargo.toml"
-  - "Cargo.lock"
+  - changed-files:
+    - any-glob-to-any-file:
+      - ".github/workflows/**"
+      - ".github/*.md"
+      - ".github/ISSUE_TEMPLATE/**"
+      - ".cargo/**"
+      - "rust-toolchain.toml"
+      - "Cargo.toml"
+      - "Cargo.lock"
 
 # Documentation and reference material.
 documentation:
-  - "docs/**"
-  - "**/*.md"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "docs/**"
+      - "**/*.md"
 
 # Persistent / temporary storage backend code paths.
 storage:
-  - "**/storage*.rs"
-  - "**/backend.rs"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "**/storage*.rs"
+      - "**/backend.rs"
 
 # Tests / property-based / fuzz harnesses.
 testing:
-  - "**/tests/**"
-  - "**/*test*.rs"
-  - "**/proptest-strategies/**"
-  - "**/fuzz_targets/**"
-  - "fuzz/**"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "**/tests/**"
+      - "**/*test*.rs"
+      - "**/proptest-strategies/**"
+      - "**/fuzz_targets/**"
+      - "fuzz/**"
 
 # Security process and security-sensitive code.
 security:
-  - "SECURITY.md"
-  - "**/security*.rs"
+  - changed-files:
+    - any-glob-to-any-file:
+      - "SECURITY.md"
+      - "**/security*.rs"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 7ee5a6ec..b3388728 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -8,8 +8,13 @@
 # `pull_request_target` is the official recipe for labeler workflows
 # because the action needs `pull-requests: write` to apply labels, and
 # that permission is only available in the base branch's context.
-# The action itself is read-only against repository code; it does not
-# evaluate `run:` from PRs.
+#
+# We explicitly check out the PR head so the labeler reads the
+# `.github/labeler.yml` from the PR branch rather than fetching the
+# base-branch copy via the API.  This lets PRs ship their own labeler
+# config fixes without a chicken-and-egg problem.  The only action
+# that consumes the checkout is `actions/labeler` (read-only YAML),
+# so the pull_request_target context remains safe.
 
 name: Pull Request Labeler
 
@@ -26,6 +31,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Apply labels
         uses: actions/labeler@v5
         with:
diff --git a/campaign/Cargo.toml b/campaign/Cargo.toml
index b7a22196..e91da883 100644
--- a/campaign/Cargo.toml
+++ b/campaign/Cargo.toml
@@ -1,8 +1,9 @@
 [package]
 name = "orbitchain-campaign"
-version = "0.1.0"
-edition = "2021"
-license = "MIT"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
 description = "OrbitChain campaign smart contract — milestones, donations, refunds, and lifecycle"
 
 [lib]
diff --git a/common/Cargo.toml b/common/Cargo.toml
index d4de44b0..8ebb5a26 100644
--- a/common/Cargo.toml
+++ b/common/Cargo.toml
@@ -1,8 +1,9 @@
 [package]
 name = "orbitchain-common"
-version = "0.1.0"
-edition = "2021"
-license = "MIT"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
 description = "OrbitChain common types — shared CampaignStatus, MilestoneStatus, and AssetInfo"
 
 [lib]
diff --git a/crates/contracts/batch-donor/Cargo.toml b/crates/contracts/batch-donor/Cargo.toml
index 3e57b060..f5b428d5 100644
--- a/crates/contracts/batch-donor/Cargo.toml
+++ b/crates/contracts/batch-donor/Cargo.toml
@@ -1,8 +1,9 @@
 [package]
 name = "orbitchain-batch-donor"
-version = "0.1.0"
-edition = "2021"
-license = "MIT"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
 description = "OrbitChain batch-donor contract — atomic multi-campaign donations in a single Soroban transaction. Closes #147."
 
 [lib]
diff --git a/token-bridge/Cargo.toml b/token-bridge/Cargo.toml
index b40633f0..3137299f 100644
--- a/token-bridge/Cargo.toml
+++ b/token-bridge/Cargo.toml
@@ -1,8 +1,9 @@
 [package]
 name = "orbitchain-token-bridge"
-version = "0.1.0"
-edition = "2021"
-license = "MIT"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
 description = "OrbitChain cross-chain token bridge contract"
 
 [lib]