diff --git a/pkg/cli/compile_workflow_processor.go b/pkg/cli/compile_workflow_processor.go
index d5175efd30..04776318a9 100644
--- a/pkg/cli/compile_workflow_processor.go
+++ b/pkg/cli/compile_workflow_processor.go
@@ -148,19 +148,19 @@ func compileWorkflowFile(
 		result.validationResult.CompiledFile = lockFile
 	}
 
-	// Collect labels from safe-outputs for JSON output (used by create-labels maintenance operation)
+	// Collect labels for JSON output (used by create-labels maintenance operation)
 	result.validationResult.Labels = extractSafeOutputLabels(workflowData)
 
 	compileWorkflowProcessorLog.Printf("Successfully processed workflow file: %s", resolvedFile)
 	return result
 }
 
-// extractSafeOutputLabels collects all unique labels referenced in safe-outputs configurations.
-// These are labels that should exist in the repository for the workflow to function correctly.
-// Scans: create-issue.labels/allowed-labels, create-discussion.labels/allowed-labels,
-// create-pull-request.labels/allowed-labels, and add-labels.allowed.
+// extractSafeOutputLabels collects all unique labels referenced by workflow configuration
+// that should exist in the repository for the workflow to function correctly.
+// Scans: safe-outputs labels (create-issue/create-discussion/create-pull-request/add-labels)
+// and on.label_command trigger labels.
 func extractSafeOutputLabels(data *workflow.WorkflowData) []string {
-	if data == nil || data.SafeOutputs == nil {
+	if data == nil {
 		return nil
 	}
 
@@ -175,38 +175,43 @@ func extractSafeOutputLabels(data *workflow.WorkflowData) []string {
 	}
 
 	so := data.SafeOutputs
-
-	if so.CreateIssues != nil {
-		for _, l := range so.CreateIssues.Labels {
-			addLabel(l)
-		}
-		for _, l := range so.CreateIssues.AllowedLabels {
-			addLabel(l)
+	if so != nil {
+		if so.CreateIssues != nil {
+			for _, l := range so.CreateIssues.Labels {
+				addLabel(l)
+			}
+			for _, l := range so.CreateIssues.AllowedLabels {
+				addLabel(l)
+			}
 		}
-	}
 
-	if so.CreateDiscussions != nil {
-		for _, l := range so.CreateDiscussions.Labels {
-			addLabel(l)
-		}
-		for _, l := range so.CreateDiscussions.AllowedLabels {
-			addLabel(l)
+		if so.CreateDiscussions != nil {
+			for _, l := range so.CreateDiscussions.Labels {
+				addLabel(l)
+			}
+			for _, l := range so.CreateDiscussions.AllowedLabels {
+				addLabel(l)
+			}
 		}
-	}
 
-	if so.CreatePullRequests != nil {
-		for _, l := range so.CreatePullRequests.Labels {
-			addLabel(l)
+		if so.CreatePullRequests != nil {
+			for _, l := range so.CreatePullRequests.Labels {
+				addLabel(l)
+			}
+			for _, l := range so.CreatePullRequests.AllowedLabels {
+				addLabel(l)
+			}
 		}
-		for _, l := range so.CreatePullRequests.AllowedLabels {
-			addLabel(l)
+
+		if so.AddLabels != nil {
+			for _, l := range so.AddLabels.Allowed {
+				addLabel(l)
+			}
 		}
 	}
 
-	if so.AddLabels != nil {
-		for _, l := range so.AddLabels.Allowed {
-			addLabel(l)
-		}
+	for _, l := range data.LabelCommand {
+		addLabel(l)
 	}
 
 	return labels
diff --git a/pkg/cli/compile_workflow_processor_test.go b/pkg/cli/compile_workflow_processor_test.go
new file mode 100644
index 0000000000..4a95f108f0
--- /dev/null
+++ b/pkg/cli/compile_workflow_processor_test.go
@@ -0,0 +1,50 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/github/gh-aw/pkg/workflow"
+)
+
+func TestExtractSafeOutputLabels_IncludesLabelCommand(t *testing.T) {
+	data := &workflow.WorkflowData{
+		SafeOutputs: &workflow.SafeOutputsConfig{
+			CreateIssues: &workflow.CreateIssuesConfig{
+				Labels:        []string{"bug"},
+				AllowedLabels: []string{"triage"},
+			},
+			AddLabels: &workflow.AddLabelsConfig{
+				Allowed: []string{"automation"},
+			},
+		},
+		LabelCommand: []string{"deploy"},
+	}
+
+	got := extractSafeOutputLabels(data)
+	want := []string{"bug", "triage", "automation", "deploy"}
+
+	if len(got) != len(want) {
+		t.Fatalf("expected %d labels, got %d: %v", len(want), len(got), got)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("expected labels %v, got %v", want, got)
+		}
+	}
+}
+
+func TestExtractSafeOutputLabels_DeduplicatesAcrossSources(t *testing.T) {
+	data := &workflow.WorkflowData{
+		SafeOutputs: &workflow.SafeOutputsConfig{
+			CreatePullRequests: &workflow.CreatePullRequestsConfig{
+				Labels: []string{"deploy"},
+			},
+		},
+		LabelCommand: []string{"deploy"},
+	}
+
+	got := extractSafeOutputLabels(data)
+	if len(got) != 1 || got[0] != "deploy" {
+		t.Fatalf("expected deduplicated labels [deploy], got %v", got)
+	}
+}