diff --git a/.github/workflows/release-hotfix.yaml b/.github/workflows/release-hotfix.yaml
index f709feb0bf..00eefe48f8 100644
--- a/.github/workflows/release-hotfix.yaml
+++ b/.github/workflows/release-hotfix.yaml
@@ -259,6 +259,10 @@ jobs:
               if: ${{ !inputs.dry_run && steps.cherry.outputs.picked_count != '0' }}
               env:
                   GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+                  # Pass via env (not ${{ }} interpolation) so the literal
+                  # backticks inside SOURCE_DESC don't get re-evaluated by
+                  # bash as command substitution.
+                  SOURCE_DESC: ${{ steps.cherry.outputs.source_desc }}
               run: |
                   set -euo pipefail
                   HOTFIX='${{ steps.plan.outputs.hotfix_branch }}'
@@ -272,7 +276,7 @@ jobs:
                   {
                     echo "Automated hotfix candidate built off \`${BASE}\`."
                     echo ""
-                    echo "- **${PICKED}** commit(s) cherry-picked from \`dev\` (${{ steps.cherry.outputs.source_desc }})"
+                    echo "- **${PICKED}** commit(s) cherry-picked from \`dev\` (${SOURCE_DESC})"
                     [[ "${DEDUP}" != "0" ]] && echo "- ${DEDUP} already applied to \`${HOTFIX}\` (skipped, see below)"
                     [[ "${SKIPPED_BREAKING}" != "0" ]] && echo "- ${SKIPPED_BREAKING} breaking change(s) skipped (see below)"
                     [[ "${CONFLICTS}" != "0" ]] && echo "- ⚠️ **${CONFLICTS}** commit(s) failed to cherry-pick (see below)"
@@ -308,6 +312,13 @@ jobs:
                     echo "See: [Hotfix Release Process](https://github.com/${{ github.repository }}/wiki/Developers#hotfix-release-process)"
                   } > /tmp/pr-body.md
 
+                  # Best-effort: ensure the hotfix label exists so --label
+                  # doesn't fail the workflow on repos that haven't created it.
+                  gh label create hotfix \
+                    --repo '${{ github.repository }}' \
+                    --color ededed \
+                    --description "Hotfix candidate" 2>/dev/null || true
+
                   gh pr create \
                     --repo '${{ github.repository }}' \
                     --base "${HOTFIX}" \