diff --git a/src/github/models.rs b/src/github/models.rs
index ccbd6ad6..7f1d8ee8 100644
--- a/src/github/models.rs
+++ b/src/github/models.rs
@@ -48,6 +48,11 @@ pub struct PullRequest {
     pub head: Option<RefInfo>,
     #[serde(default)]
     pub base: Option<RefInfo>,
+    // Present on both the list and single-PR endpoints -- `worktree::pr_ci_status`
+    // reads these to spot the auto-merge approval marker (see
+    // `supervisor::PR_APPROVAL_LABEL`) without a second round-trip.
+    #[serde(default)]
+    pub labels: Vec<Label>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
@@ -281,6 +286,26 @@ mod pr_status_model_tests {
         assert_eq!(pr.base.unwrap().git_ref, "main");
     }
 
+    #[test]
+    fn pull_request_deserializes_labels() {
+        let json = serde_json::json!({
+            "number": 5, "html_url": "u", "state": "open", "title": "t",
+            "labels": [{"name": "status:pr:approved"}, {"name": "size/s"}]
+        });
+        let pr: PullRequest = serde_json::from_value(json).unwrap();
+        assert_eq!(pr.labels.len(), 2);
+        assert_eq!(pr.labels[0].name, "status:pr:approved");
+    }
+
+    #[test]
+    fn pull_request_tolerates_absent_labels() {
+        let json = serde_json::json!({
+            "number": 5, "html_url": "u", "state": "open", "title": "t"
+        });
+        let pr: PullRequest = serde_json::from_value(json).unwrap();
+        assert!(pr.labels.is_empty());
+    }
+
     #[test]
     fn check_run_deserializes_with_null_conclusion() {
         let json =
diff --git a/src/supervisor.rs b/src/supervisor.rs
index e18fc409..dde2c8d7 100644
--- a/src/supervisor.rs
+++ b/src/supervisor.rs
@@ -36,6 +36,15 @@ const NEEDS_HUMAN_GATE_LABEL: &str = "needs-human-gate";
 /// after removing it).
 const NEEDS_DECISION_LABEL: &str = "needs-decision";
 
+/// GitHub label a human applies to a CI-green PR to explicitly sign off on
+/// `run_review_sweep`'s `Passing` branch auto-merging it (item #194). CI
+/// green is what routes an item into that branch in the first place, so
+/// this label only ever adds a gate on top of CI, never bypasses it --
+/// mirrors item #192's "never bypass CI" principle for the duplicate-PR
+/// guard. Single named constant so the label convention has one place to
+/// rename.
+const PR_APPROVAL_LABEL: &str = "status:pr:approved";
+
 /// `vault` secret holding the Telegram chat id human-gate pings go to.
 /// Reuses the same `channels`/`vault` path as `agentflare channel send`
 /// rather than inventing a separate config store for one setting -- set it
@@ -548,9 +557,14 @@ pub(crate) fn run_review_sweep(
                         SelfRepairOutcome::Skipped => result.skipped += 1,
                     }
                 }
-                crate::worktree::PrCiStatus::Pending
-                | crate::worktree::PrCiStatus::Passing
-                | crate::worktree::PrCiStatus::Unknown => {
+                crate::worktree::PrCiStatus::Passing { number, labels } => {
+                    if merge_if_approved(mcp, item, &repo_root, number, &labels) {
+                        result.promoted += 1;
+                    } else {
+                        result.skipped += 1;
+                    }
+                }
+                crate::worktree::PrCiStatus::Pending | crate::worktree::PrCiStatus::Unknown => {
                     result.skipped += 1;
                 }
             }
@@ -573,6 +587,52 @@ fn promote_merged_item(mcp: &AgentflareMcp, item: &agentflare_backend::item::Ite
         .unwrap_or(false)
 }
 
+/// Auto-merges a CI-green PR and promotes its item, but only once a human
+/// has attached `PR_APPROVAL_LABEL` to the PR itself -- checked first and
+/// short-circuits before any GitHub call so an unapproved item never touches
+/// the network here. Only ever called from `run_review_sweep`'s `Passing`
+/// arm, so CI green is structurally required: the label can add a gate on
+/// top of it, never bypass it.
+fn merge_if_approved(
+    mcp: &AgentflareMcp,
+    item: &agentflare_backend::item::Item,
+    repo_root: &std::path::Path,
+    number: u64,
+    labels: &[String],
+) -> bool {
+    if !labels.iter().any(|l| l == PR_APPROVAL_LABEL) {
+        return false;
+    }
+    let Some(repo) = crate::github::RepoId::resolve_from_remote(repo_root) else {
+        return false;
+    };
+    let Ok(client) = crate::github::Client::new() else {
+        return false;
+    };
+    merge_approved_pr(&client, &repo, number) && promote_merged_item(mcp, item)
+}
+
+/// The actual GitHub merge call for an approved, CI-green PR. Split out from
+/// `merge_if_approved` so tests can drive it against a mock server instead
+/// of `Client::new()`'s real credentials/host, mirroring `github::pulls`'
+/// own test style. Squash matches this repo's existing single-commit-per-item
+/// convention. Logs and falls through (never retries in-line) on failure --
+/// branch protection or a merge conflict just means the item sits until the
+/// next sweep tick, same as any other `skipped` outcome.
+fn merge_approved_pr(
+    client: &crate::github::Client,
+    repo: &crate::github::RepoId,
+    number: u64,
+) -> bool {
+    match crate::github::pulls::merge(client, repo, number, "squash") {
+        Ok(()) => true,
+        Err(e) => {
+            eprintln!("agentflare-supervisor: auto-merge failed for PR #{number} in {repo}: {e}");
+            false
+        }
+    }
+}
+
 /// Whether an `agentflare-work` job is already queued or running for
 /// `item_id` -- guards the (small) window between `enqueue_work_job`
 /// returning and the job actually reaching `item_claim`, during which the
diff --git a/src/supervisor_tests.rs b/src/supervisor_tests.rs
index a9e247e6..0e803e0f 100644
--- a/src/supervisor_tests.rs
+++ b/src/supervisor_tests.rs
@@ -1001,6 +1001,115 @@ fn run_review_sweep_scans_in_review_items_from_every_registered_project_not_just
     );
 }
 
+// --- auto-merge on CI-green + approval label (item #194) ---
+
+#[test]
+fn merge_approved_pr_merges_via_squash_on_success() {
+    let server = crate::github::test_support::MockServer::start(vec![
+        crate::github::test_support::MockResponse::json(200, r#"{"merged":true}"#),
+    ]);
+    let client = server.client(Some("tok"));
+    let repo = crate::github::RepoId {
+        owner: "o".into(),
+        repo: "r".into(),
+    };
+
+    assert!(merge_approved_pr(&client, &repo, 42));
+
+    let reqs = server.requests();
+    assert_eq!(reqs[0].method, "PUT");
+    assert_eq!(reqs[0].path, "/repos/o/r/pulls/42/merge");
+    let sent: serde_json::Value = serde_json::from_str(&reqs[0].body).unwrap();
+    assert_eq!(sent["merge_method"], "squash");
+}
+
+#[test]
+fn merge_approved_pr_returns_false_and_does_not_panic_on_github_error() {
+    // Branch protection / an unresolved conflict -- GitHub answers 405 on
+    // the merge endpoint. The safety property is that this falls through to
+    // `skipped` (no panic, no retry loop here); the sweep just polls again
+    // next tick.
+    let server = crate::github::test_support::MockServer::start(vec![
+        crate::github::test_support::MockResponse::json(405, r#"{"message":"not mergeable"}"#),
+    ]);
+    let client = server.client(Some("tok"));
+    let repo = crate::github::RepoId {
+        owner: "o".into(),
+        repo: "r".into(),
+    };
+
+    assert!(!merge_approved_pr(&client, &repo, 42));
+}
+
+#[test]
+fn merge_if_approved_skips_without_touching_network_when_label_is_absent() {
+    // No approval label on the PR -- CI green alone must never be enough to
+    // merge. The label check must happen before any GitHub call, so this
+    // must return false even with an unresolvable repo/no credentials.
+    let repo = throwaway_repo();
+    let mcp = test_mcp_with_repo(repo.path().to_path_buf());
+    let item_id = seed_in_review_item(&mcp, Some("claude-code"));
+    let item = mcp
+        .with_backend_db(|conn| agentflare_backend::item::get(conn, &item_id).unwrap())
+        .unwrap();
+
+    let merged = merge_if_approved(&mcp, &item, repo.path(), 42, &["size/s".to_string()]);
+
+    assert!(!merged);
+    let still_in_review = mcp
+        .with_backend_db(|conn| {
+            let refetched = agentflare_backend::item::get(conn, &item_id).unwrap();
+            let state = agentflare_backend::state::get(conn, &refetched.state_id).unwrap();
+            state.group_name == "in_review"
+        })
+        .unwrap();
+    assert!(still_in_review, "an unapproved item must not be promoted");
+}
+
+#[test]
+fn run_review_sweep_never_merges_when_the_approval_label_only_exists_on_the_project_not_the_pr() {
+    // Regression for the safety property in item #194's spec: the approval
+    // label must gate on the PR's OWN GitHub labels (carried by
+    // `PrCiStatus::Passing`), never merely on the label existing somewhere
+    // in the project's label table. A throwaway repo with no remote always
+    // resolves to `PrCiStatus::Unknown`, so this also covers Pending/Failing
+    // by construction -- none of those variants carry PR labels for
+    // `merge_if_approved` to check in the first place.
+    let repo = throwaway_repo();
+    let mcp = test_mcp_with_repo(repo.path().to_path_buf());
+    let _item_id = seed_in_review_item(&mcp, Some("claude-code"));
+    mcp.with_backend_db(|conn| {
+        let project = mcp.resolve_project(conn).unwrap();
+        agentflare_backend::label::create(
+            conn,
+            agentflare_backend::label::CreateLabel {
+                project_id: Some(project.id.clone()),
+                workspace_id: project.workspace_id.clone(),
+                name: PR_APPROVAL_LABEL.into(),
+                color: None,
+                parent_id: None,
+                sort_order: None,
+                external_source: None,
+                external_id: None,
+            },
+        )
+        .unwrap();
+    })
+    .unwrap();
+    let queue = test_queue();
+    let auth_conn = test_auth_conn();
+
+    let result = run_review_sweep(
+        &mcp,
+        &queue,
+        &auth_conn,
+        agentflare_resource_gate::Policy::Normal,
+    );
+
+    assert_eq!(result.promoted, 0);
+    assert_eq!(result.skipped, 1);
+}
+
 #[test]
 fn self_repair_or_gate_dispatches_a_job_and_posts_a_marker_comment() {
     let mcp = test_mcp();
diff --git a/src/worktree.rs b/src/worktree.rs
index 6994f01f..418647b0 100644
--- a/src/worktree.rs
+++ b/src/worktree.rs
@@ -155,7 +155,8 @@ pub fn relabel_pr_completed(item: &agentflare_backend::item::Item, repo_root: &P
 }
 
 /// CI signal the in-review sweep (`supervisor::run_review_sweep`, item #65)
-/// polls per item: merged (promote), failing (self-repair), or nothing
+/// polls per item: merged (promote), failing (self-repair), CI-green with a
+/// human approval label attached (auto-merge, item #194), or nothing
 /// actionable yet. `Unknown` covers every soft-fail case `is_pr_merged`
 /// above also treats as "not merged yet" -- no credentials, no resolvable
 /// remote, no PR found, or a lookup error -- since the caller's fallback is
@@ -164,7 +165,13 @@ pub enum PrCiStatus {
     Merged,
     Failing(Vec<String>),
     Pending,
-    Passing,
+    /// CI is green. Carries the PR number and its GitHub label names so
+    /// `run_review_sweep` can decide whether to auto-merge without a second
+    /// API round-trip just to re-fetch labels.
+    Passing {
+        number: u64,
+        labels: Vec<String>,
+    },
     Unknown,
 }
 
@@ -228,7 +235,10 @@ pub fn pr_ci_status(item: &agentflare_backend::item::Item, repo_root: &Path) ->
         })
         .unwrap_or_default();
     if failed.is_empty() {
-        PrCiStatus::Passing
+        PrCiStatus::Passing {
+            number: pr.number,
+            labels: pr.labels.into_iter().map(|l| l.name).collect(),
+        }
     } else {
         PrCiStatus::Failing(failed)
     }