diff --git a/.gitlab/blackduck.yml b/.gitlab/blackduck.yml
index a516204850..d4574e9c61 100644
--- a/.gitlab/blackduck.yml
+++ b/.gitlab/blackduck.yml
@@ -6,8 +6,7 @@
   rules:
     - if: $CI_COMMIT_REF_PROTECTED && $CI_COMMIT_TAG
     - if: $CI_PIPELINE_SOURCE == "schedule"
-    - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
-      when: manual
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /ci::allow-expensive-jobs/'
   before_script:
     - touch .build_failed
     - export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/blackduck scan \(.*\)/\1/')"