diff --git a/.github/workflows/polkadot-companion-labels.yml b/.github/workflows/polkadot-companion-labels.yml
deleted file mode 100644
index 3c3987b5f4d56..0000000000000
--- a/.github/workflows/polkadot-companion-labels.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Check Polkadot Companion and Label
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-  
-jobs:
-  check_status:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Monitor the status of the gitlab-check-companion-build job
-        uses: s3krit/await-status-action@v1.0.1
-        id: 'check-companion-status'
-        with:
-          authToken: ${{ secrets.GITHUB_TOKEN }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          contexts: 'continuous-integration/gitlab-check-polkadot-companion-build'
-          timeout: 1800
-          notPresentTimeout: 3600 # It can take quite a while before the job starts on Gitlab when the CI queue is large
-          failureStates: failure
-          interruptedStates: error # Error = job was probably cancelled. We don't want to label the PR in that case
-          pollInterval: 30
-      - name: Label success
-        uses: andymckay/labeler@master
-        if: steps.check-companion-status.outputs.result == 'success'
-        with:
-          remove-labels: 'A7-needspolkadotpr'
-      - name: Label failure
-        uses: andymckay/labeler@master
-        if: steps.check-companion-status.outputs.result == 'failure'
-        with:
-          add-labels: 'A7-needspolkadotpr'
diff --git a/.maintain/common/lib.sh b/.maintain/common/lib.sh
index ce6c566d799ab..ee0032f34f958 100755
--- a/.maintain/common/lib.sh
+++ b/.maintain/common/lib.sh
@@ -22,7 +22,7 @@ last_github_release(){
   i=0
   # Iterate over releases until we find the last release that's not just a draft
   while [ $i -lt 29 ]; do
-    out=$(curl -H "Authorization: token $GITHUB_RELEASE_TOKEN" -s "$api_base/$1/releases" | jq ".[$i]")
+    out=$(curl -H "Authorization: token $(github_token)" -s "$api_base/$1/releases" | jq ".[$i]")
     echo "$out"
     # Ugh when echoing to jq, we need to translate newlines into spaces :/
     if [ "$(echo "$out" | tr '\r\n' ' ' | jq '.draft')" = "false" ]; then
@@ -41,13 +41,13 @@ last_github_release(){
 check_tag () {
   repo=$1
   tagver=$2
-  tag_out=$(curl -H "Authorization: token $GITHUB_RELEASE_TOKEN" -s "$api_base/$repo/git/refs/tags/$tagver")
+  tag_out=$(curl -H "Authorization: token $(github_token)" -s "$api_base/$repo/git/refs/tags/$tagver")
   tag_sha=$(echo "$tag_out" | jq -r .object.sha)
   object_url=$(echo "$tag_out" | jq -r .object.url)
   if [ "$tag_sha" = "null" ]; then
     return 2
   fi
-  verified_str=$(curl -H "Authorization: token $GITHUB_RELEASE_TOKEN" -s "$object_url" | jq -r .verification.verified)
+  verified_str=$(curl -H "Authorization: token $(github_token)" -s "$object_url" | jq -r .verification.verified)
   if [ "$verified_str" = "true" ]; then
     # Verified, everything is good
     return 0
@@ -67,16 +67,7 @@ has_label(){
   pr_id="$2"
   label="$3"
 
-  # These will exist if the function is called in Gitlab.
-  # If the function's called in Github, we should have GITHUB_ACCESS_TOKEN set
-  # already.
-  if [ -n "$GITHUB_RELEASE_TOKEN" ]; then
-    GITHUB_TOKEN="$GITHUB_RELEASE_TOKEN"
-  elif [ -n "$GITHUB_PR_TOKEN" ]; then
-    GITHUB_TOKEN="$GITHUB_PR_TOKEN"
-  fi
-
-  out=$(curl -H "Authorization: token $GITHUB_TOKEN" -s "$api_base/$repo/pulls/$pr_id")
+  out=$(curl -H "Authorization: token $(github_token)" -s "$api_base/$repo/pulls/$pr_id")
   [ -n "$(echo "$out" | tr -d '\r\n' | jq ".labels | .[] | select(.name==\"$label\")")" ]
 }
 
@@ -115,3 +106,51 @@ has_runtime_changes() {
     return 1
   fi
 }
+
+# Add a label to a PR in a given repo. Doesn't error if label already present
+# repo: paritytech/substrate
+# label: A7-needspolkadotpr
+# PR: 1234
+add_label() {
+  repo=$1
+  pr=$2
+  label=$3
+  curl -X POST \
+    --data "[\"$label\"]" \
+    -H "Accept: application/vnd.github.v3+json" \
+    -H "Authorization: token $(github_token)" \
+    -s "$api_base/$repo/issues/$pr/labels"
+}
+
+# Remove a label from a PR in a given repo. Doesn't error if label already absent
+# repo: paritytech/substrate
+# label: A7-needspolkadotpr
+# PR: 1234
+remove_label() {
+  repo=$1
+  pr=$2
+  # Escape the labels... we use emojis quite often, so this is required
+  # to not break things.
+  # Source below: (with od instead of xxd since it's in IEEE Std 1003.1-2008)
+  # https://stackoverflow.com/questions/12735450/delete-using-curl-with-encoded-url
+  label=$(printf '%s' "$3" | od -A n -w1000 -t x1 | tr -d ' ' | sed 's/\(..\)/%\1/g')
+
+  curl -X DELETE \
+    -H "Accept: application/vnd.github.v3+json" \
+    -H "Authorization: token $(github_token)" \
+    -s "$api_base/$repo/issues/$pr/labels/$label"
+}
+
+# Useful shim for getting the right GITHUB_TOKEN, depending on whether we're
+# in Github or Gitlab CI
+github_token() {
+  # These will exist if the function is called in Gitlab.
+  # If the function's called in Github, we should have GITHUB_ACCESS_TOKEN set
+  # already.
+  if [ -n "$GITHUB_RELEASE_TOKEN" ]; then
+    GITHUB_TOKEN="$GITHUB_RELEASE_TOKEN"
+  elif [ -n "$GITHUB_PR_TOKEN" ]; then
+    GITHUB_TOKEN="$GITHUB_PR_TOKEN"
+  fi
+  printf '%s' "$GITHUB_TOKEN"
+}
diff --git a/.maintain/gitlab/check_polkadot_companion_build.sh b/.maintain/gitlab/check_polkadot_companion_build.sh
index 89780f082e45b..2f8e55c9fb9e5 100755
--- a/.maintain/gitlab/check_polkadot_companion_build.sh
+++ b/.maintain/gitlab/check_polkadot_companion_build.sh
@@ -11,12 +11,15 @@
 
 set -e
 
+#shellcheck source=../common/lib.sh
+. "$(dirname "${0}")/../common/lib.sh"
+
 github_api_substrate_pull_url="https://api.github.com/repos/paritytech/substrate/pulls"
 # use github api v3 in order to access the data without authentication
 github_header="Authorization: token ${GITHUB_PR_TOKEN}"
 
-boldprint () { printf "|\n| \033[1m${@}\033[0m\n|\n" ; }
-boldcat () { printf "|\n"; while read l; do printf "| \033[1m${l}\033[0m\n"; done; printf "|\n" ; }
+boldprint () { printf "|\n| \033[1m%s\033[0m\n|\n" "{@}"; }
+boldcat () { printf "|\n"; while read -r l; do printf "| \033[1m%s\033[0m\n" "${l}"; done; printf "|\n" ; }
 
 
 
@@ -55,6 +58,7 @@ cd polkadot
 
 # either it's a pull request then check for a companion otherwise use
 # polkadot:master
+# shellcheck disable=2003
 if expr match "${CI_COMMIT_REF_NAME}" '^[0-9]\+$' >/dev/null
 then
   boldprint "this is pull request no ${CI_COMMIT_REF_NAME}"
@@ -74,8 +78,8 @@ then
   if [ "${pr_companion}" ]
   then
     boldprint "companion pr specified/detected: #${pr_companion}"
-    git fetch origin refs/pull/${pr_companion}/head:pr/${pr_companion}
-    git checkout pr/${pr_companion}
+    git fetch origin "refs/pull/${pr_companion}/head:pr/${pr_companion}"
+    git checkout "pr/${pr_companion}"
     git merge origin/master
   else
     boldprint "no companion branch found - building polkadot:master"
@@ -89,4 +93,12 @@ fi
 diener patch --crates-to-patch ../ --substrate --path Cargo.toml
 
 # Test Polkadot pr or master branch with this Substrate commit.
-time cargo test --all --release --verbose
+# If it fails, it requires a companion PR. Label thusly. Otherwise remove the
+# label. These operations are idempotent.
+if time cargo test --all --release --verbose ; then
+  remove_label 'paritytech/substrate' "${CI_COMMIT_REF_NAME}" 'A7-needspolkadotpr'
+  exit 0
+else
+  add_label 'paritytech/substrate' "${CI_COMMIT_REF_NAME}" 'A7-needspolkadotpr'
+  exit 1
+fi