diff --git a/.github/workflows/auto-label-needs-discussion.yml b/.github/workflows/auto-label-needs-discussion.yml
new file mode 100644
index 00000000000..3826a41a736
--- /dev/null
+++ b/.github/workflows/auto-label-needs-discussion.yml
@@ -0,0 +1,49 @@
+name: 'Auto-apply `needs-discussion` label to externally raised Issues'
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  label-if-external:
+    runs-on: ubuntu-latest
+    if: github.repository == 'renovatebot/renovate'
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const author = context.payload.issue.user.login;
+
+            let roleName;
+            try {
+              const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: author,
+              });
+              roleName = data.role_name;
+            } catch (err) {
+              if (err.status === 404) {
+                // User is not a collaborator — treat as no access
+                roleName = 'none';
+              } else {
+                throw err;
+              }
+            }
+
+            // allow users who have a minimum of Triage access on the project to raise Issues without auto-labelling
+            const triagePlus = ['admin', 'maintain', 'write', 'triage'];
+            if (!triagePlus.includes(roleName)) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                labels: ['needs-discussion'],
+              });
+              core.info(`Added 'needs-discussion' label (author role: ${roleName})`);
+            } else {
+              core.info(`Skipping label — author has ${roleName} access`);
+            }