diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 18c553a..14c880c 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -8,7 +8,9 @@ on:
 
 permissions:
   actions: write
+  checks: read
   contents: write
+  issues: write
   pull-requests: write
   statuses: write
 
@@ -28,8 +30,12 @@ jobs:
           allowlist: dependabot[bot]
           lock-pullrequest-aftermerge: false
 
+  label:
+    needs: CLAssistant
+    if: always() && (github.event_name == 'pull_request_target' || github.event.issue.pull_request)
+    runs-on: ubuntu-latest
+    steps:
       - name: Label CLA status
-        if: always() && (github.event_name == 'pull_request_target' || github.event.issue.pull_request)
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
@@ -42,14 +48,14 @@ jobs:
             // Get the PR to read head SHA
             const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
 
-            // Read the CLA commit status
-            const { data: statuses } = await github.rest.repos.listCommitStatusesForRef({
+            // Read the CLA check run (the CLA Assistant uses check runs, not commit statuses)
+            const { data: checkRuns } = await github.rest.checks.listForRef({
               owner, repo, ref: pr.head.sha,
             });
-            const claStatus = statuses.find(s => s.context === 'license/cla');
-            if (!claStatus) return;
+            const claCheck = checkRuns.check_runs.find(cr => cr.name === 'CLAssistant');
+            if (!claCheck || claCheck.status !== 'completed') return;
 
-            const signed = claStatus.state === 'success';
+            const signed = claCheck.conclusion === 'success';
             const addLabel = signed ? 'cla: signed' : 'cla: needed';
             const removeLabel = signed ? 'cla: needed' : 'cla: signed';