diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 0082d066..5c18c29f 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -80,6 +80,7 @@ When a Konflux build check fails on a pull request, this action will automatical
 - **Auto-Cleanup**: Removes old retest comments when new commits are pushed
 - **Filtered Checks**: Only retests checks matching a specific name suffix (e.g., `-on-push`)
 - **Custom Retest Command**: Configure the command used to trigger retests (default: `/retest`)
+- **Disable via Label**: Add the `disable-konflux-auto-retest` label to a PR to skip automatic retesting
 
 
 ### Usage
diff --git a/.github/workflows/retest-konflux-builds.yml b/.github/workflows/retest-konflux-builds.yml
index a2a67e11..ae5f687f 100644
--- a/.github/workflows/retest-konflux-builds.yml
+++ b/.github/workflows/retest-konflux-builds.yml
@@ -40,6 +40,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RETEST_COMMAND: ${{ inputs.retest_command }}
         run: |
+          set -euo pipefail
           PR_NUMBER="${{ github.event.pull_request.number }}"
 
           echo "New commit pushed to PR #$PR_NUMBER. Cleaning up existing $RETEST_COMMAND comments from GitHub Actions..."
@@ -62,7 +63,7 @@ jobs:
   auto-retest-failed-konflux-build:
     if: |
       github.event_name == 'check_run' &&
-      github.event.check_run.pull_requests[0] != null &&
+      github.event.check_run.pull_requests.length > 0 &&
       github.event.check_run.conclusion == 'failure' &&
       startsWith(github.event.check_run.name, 'Red Hat Konflux')
     runs-on: ubuntu-latest
@@ -81,7 +82,16 @@ jobs:
           CHECK_NAME_SUFFIX: ${{ inputs.check_name_suffix }}
           RETEST_COMMAND: ${{ inputs.retest_command }}
         run: |
+          set -euo pipefail
           CHECK_NAME="${{ github.event.check_run.name }}"
+          PR_NUMBER="${{ github.event.check_run.pull_requests[0].number }}"
+
+          # Fetch current PR labels to avoid race conditions with stale event data
+          CURRENT_LABELS="$(gh pr view "$PR_NUMBER" --repo ${{ github.repository }} --json labels --jq '.labels[].name')"
+          if echo "$CURRENT_LABELS" | grep -q "^disable-konflux-auto-retest$"; then
+            echo "Skipping retest: disable-konflux-auto-retest label is present"
+            exit 0
+          fi
 
           # Check if the check name ends with the configured suffix
           if [[ ! "$CHECK_NAME" == *"$CHECK_NAME_SUFFIX" ]]; then