diff --git a/.github/scripts/tests/ci-routing.test.mjs b/.github/scripts/tests/ci-routing.test.mjs
index 3b590332789..da1824cfa51 100644
--- a/.github/scripts/tests/ci-routing.test.mjs
+++ b/.github/scripts/tests/ci-routing.test.mjs
@@ -98,7 +98,20 @@ const stackedBase = {
 
 const routeCases = [
   ["allowlisted PR", {}, awsRunner],
-  ["allowlisted profile label", { EVENT_ACTION: "labeled", EVENT_LABEL_NAME: "profile-ci" }, awsRunner],
+  ...["profile-ci", "full-ci"].flatMap((label) => {
+    const event = { EVENT_ACTION: "labeled", EVENT_LABEL_NAME: label };
+    return [
+      [`allowlisted ${label} label`, event, awsRunner],
+      [`${label} with unlisted author`, { ...event, EVENT_PR_AUTHOR_ID: "99999999" }],
+      [`${label} with unlisted sender`, { ...event, EVENT_SENDER_ID: "99999999" }],
+      [`${label} with unlisted rerun actor`, { ...event, TEST_TRIGGERING_ACTOR_ID: "99999999" }],
+      [`${label} on non-owner PR with owner sender and rerun`, {
+        ...event, EVENT_PR_AUTHOR_ID: "99999999", TEST_PR_AUTHOR_ID: "99999999", TRUSTED_USER_IDS: "[34892728,99999999]",
+      }],
+      [`${label} with non-owner sender`, { ...event, EVENT_SENDER_ID: "99999999", TRUSTED_USER_IDS: "[34892728,99999999]" }],
+      [`${label} with non-owner rerun actor`, { ...event, TEST_TRIGGERING_ACTOR_ID: "99999999", TRUSTED_USER_IDS: "[34892728,99999999]" }],
+    ];
+  }),
   ["unrelated label", { EVENT_ACTION: "labeled", EVENT_LABEL_NAME: "documentation" }],
   ["validated stacked base", stackedBase, awsRunner],
   ["lagging PR API base snapshot", { TEST_PR_BASE_SHA: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" }, awsRunner],
diff --git a/.github/workflows/ci-routing.yml b/.github/workflows/ci-routing.yml
index 7fc7416f369..3afa9f0859d 100644
--- a/.github/workflows/ci-routing.yml
+++ b/.github/workflows/ci-routing.yml
@@ -86,8 +86,8 @@ jobs:
           [[ "$EVENT_BASE_REPOSITORY_ID" == '1170821064' ]] || fail_closed 'unexpected base repository ID'
           [[ -n "$EVENT_BASE_REF" ]] || fail_closed 'missing base branch'
           [[ "$EVENT_ACTION" =~ ^(opened|reopened|synchronize|labeled)$ ]] || fail_closed 'unsupported pull_request action'
-          if [[ "$EVENT_ACTION" == 'labeled' && "${EVENT_LABEL_NAME:-}" != 'profile-ci' ]]; then
-            fail_closed 'only the profile-ci label can request a profiling run'
+          if [[ "$EVENT_ACTION" == 'labeled' && ! "${EVENT_LABEL_NAME:-}" =~ ^(profile-ci|full-ci)$ ]]; then
+            fail_closed 'only the profile-ci or full-ci labels can request CI'
           fi
 
           jq -e '
diff --git a/doc/DEVELOPING.md b/doc/DEVELOPING.md
index 38a217d3579..7997238437e 100644
--- a/doc/DEVELOPING.md
+++ b/doc/DEVELOPING.md
@@ -164,6 +164,9 @@ history, changed PR heads and unverifiable ancestry still deny AWS execution.
 Missing or malformed settings
 and unverifiable authorization use GitHub-hosted runners. A maintainer rerunning
 an outside contributor's PR does not grant it AWS access.
+Both `full-ci` and `profile-ci` label events use this same authorization path.
+The labels request CI scope; they do not grant AWS access or move an authorized
+CODEOWNER run to GitHub-hosted capacity. Other label events do not request CI.
 Authorized test jobs and the final `verify` and `e2e` aggregates use the selected
 AWS fleet. A stale admission roster can allocate only the short metadata gate;
 the fresh CODEOWNERS check still denies PR execution for a removed owner.