diff --git a/.github/workflows/paddle_musa_ci.yml b/.github/workflows/paddle_musa_ci.yml
index 5a657c7..11cb2f1 100644
--- a/.github/workflows/paddle_musa_ci.yml
+++ b/.github/workflows/paddle_musa_ci.yml
@@ -1,12 +1,16 @@
 name: paddle_musa_ci
 
 on:
-  workflow_dispatch:
-  push:
   pull_request:
+    types: [labeled]
+
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
   paddle_musa:
+    if: github.event.label.name == 'run-musa-ci'
     runs-on: [self-hosted]
     timeout-minutes: 360
 
@@ -19,7 +23,10 @@ jobs:
 
       - name: Run paddle_musa CI
         run: |
+          CI_CONTAINER="paddle_musa_github_ci_${GITHUB_RUN_ID}_${GITHUB_RUN_ATTEMPT}"
+
           docker run --rm \
+            --name "${CI_CONTAINER}" \
             --network host \
             --user root \
             --shm-size 20G \
@@ -58,4 +65,3 @@ jobs:
               cd ./backends/musa
               bash tools/run_ut.sh
             '
-