diff --git a/commands/gsd/forensics.md b/commands/gsd/forensics.md
index 3bf67d2c7..86612c0aa 100644
--- a/commands/gsd/forensics.md
+++ b/commands/gsd/forensics.md
@@ -49,7 +49,7 @@ Read and execute the forensics workflow from @~/.claude/get-shit-done/workflows/
 </success_criteria>
 
 <critical_rules>
-- **Read-only investigation:** Do not modify any project files during forensics. Only write the report.
+- **Read-only investigation:** Do not modify project source files during forensics. Only write the forensic report and update STATE.md session tracking.
 - **Redact sensitive data:** Strip absolute paths, API keys, tokens from reports and issues.
 - **Ground findings in evidence:** Every anomaly must cite specific commits, files, or state data.
 - **No speculation without evidence:** If data is insufficient, say so — do not fabricate root causes.
diff --git a/get-shit-done/workflows/forensics.md b/get-shit-done/workflows/forensics.md
index 42952cafe..645eb2f11 100644
--- a/get-shit-done/workflows/forensics.md
+++ b/get-shit-done/workflows/forensics.md
@@ -243,9 +243,16 @@ If actionable anomalies were found (HIGH or MEDIUM confidence):
 
 If confirmed:
 ```bash
+# Check if "bug" label exists before using it
+BUG_LABEL=$(gh label list --search "bug" --json name -q '.[0].name' 2>/dev/null)
+LABEL_FLAG=""
+if [ -n "$BUG_LABEL" ]; then
+  LABEL_FLAG="--label bug"
+fi
+
 gh issue create \
   --title "bug: {concise description from anomaly}" \
-  --label "bug" \
+  $LABEL_FLAG \
   --body "{formatted findings from report}"
 ```