diff --git a/.github/workflows/dependency-update.yml b/.github/workflows/dependency-update.yml
index 9aa73b3ec..62cbc9c53 100644
--- a/.github/workflows/dependency-update.yml
+++ b/.github/workflows/dependency-update.yml
@@ -112,6 +112,7 @@ jobs:
 
           PR_URL=$(gh pr create \
                       --base "$BASE_BRANCH" \
+                      --label "security" \
                       --title "Update dependencies to fix vulnerabilities ($(date '+%Y-%m-%d'))" \
                       --body "$PR_BODY")
 
diff --git a/doc/changes/unreleased.md b/doc/changes/unreleased.md
index 4fcaebf47..63b459a93 100644
--- a/doc/changes/unreleased.md
+++ b/doc/changes/unreleased.md
@@ -5,6 +5,10 @@
 Updated the nox DB-version default to come from `BaseConfig` instead of the hardcoded `7.1.9`,
 so ITDE-related test flows use the configured Exasol baseline and unit-test help no longer advertises `--db-version`.
 
+## Feature
+
+* #874: Added the `security` label to dependency update PR creation
+
 ## Bug
 
 * #744: Updated nox DB-version handling to use `BaseConfig.minimum_exasol_version` instead hardcoded `7.1.9`
diff --git a/exasol/toolbox/templates/github/workflows/dependency-update.yml b/exasol/toolbox/templates/github/workflows/dependency-update.yml
index 2b19eba2c..9979a99e8 100644
--- a/exasol/toolbox/templates/github/workflows/dependency-update.yml
+++ b/exasol/toolbox/templates/github/workflows/dependency-update.yml
@@ -111,6 +111,7 @@ jobs:
 
           PR_URL=$(gh pr create \
                       --base "$BASE_BRANCH" \
+                      --label "security" \
                       --title "Update dependencies to fix vulnerabilities ($(date '+%Y-%m-%d'))" \
                       --body "$PR_BODY")