diff --git a/docs/policy.md b/docs/policy.md
index 3cf9c21..9c14d87 100644
--- a/docs/policy.md
+++ b/docs/policy.md
@@ -58,7 +58,7 @@ A weekly scout searches npm for packages published since V2 shipped that depend
 | Workflow | When | What |
 | :--- | :--- | :--- |
 | `validate-pr.yml` | every PR | Required `validate` check |
-| `triage.yml` | PR opened/updated | Labels and a results comment (base-branch code only) |
+| `triage.yml` | PR opened/updated | Labels and a results comment (base-branch code only). `needs-human` is only ever removed by a maintainer |
 | `generate-readme.yml` | push to main | README.md and dist/registry.json; fails without writing on any invalid entry. The regenerated commit goes through a bot PR (`bot/readme-*`) that merges itself once `validate` passes |
 | `site.yml` | push to main, daily | Search site on GitHub Pages |
 | `health.yml` | daily | Health report issue, rename and removal PRs |
diff --git a/scripts/triage.js b/scripts/triage.js
index bd4e75b..827e94b 100644
--- a/scripts/triage.js
+++ b/scripts/triage.js
@@ -34,7 +34,11 @@ async function main() {
   console.log('labels:', result.labels.join(', ') || '(none)');
   if (dryRun) return;
 
-  await setTriageLabels(number, result.labels, current);
+  // needs-human is a maintainer gate: the bot may add it but never clears it or marks the PR ready
+  const labels = current.includes('needs-human')
+    ? [...new Set([...result.labels.filter(l => l !== 'ready'), 'needs-human'])]
+    : result.labels;
+  await setTriageLabels(number, labels, current);
   await addLabels(number, result.categories.map(c => `category: ${c}`).filter(l => !current.includes(l)));
   if (result.dataChanged || result.errors.length) {
     await upsertComment(number, MARKER, report);