diff --git a/.github/workflows/trigger-integration-tests.yml b/.github/workflows/trigger-integration-tests.yml
new file mode 100644
index 00000000..a1347c7e
--- /dev/null
+++ b/.github/workflows/trigger-integration-tests.yml
@@ -0,0 +1,51 @@
+name: Trigger Integration Tests
+
+on:
+  # Use pull_request_target for fork PRs to access secrets when labeled by maintainers
+  # This is safe because:
+  # 1. We don't checkout or execute any code from the PR
+  # 2. We only read PR metadata and dispatch to another repo
+  # 3. The label must be manually added by someone with write access
+  pull_request_target:
+    types: [labeled]
+  push:
+    branches:
+      - master
+
+jobs:
+  trigger-on-label:
+    if: github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'test-iiab-integration')
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Trigger integration tests
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.INTEGRATION_TEST_PAT }}
+          repository: ascoderu/iiab-lokole-tests
+          event-type: test-integration-lokole
+          client-payload: |
+            {
+              "pr_number": ${{ github.event.pull_request.number }},
+              "ref": "${{ github.event.pull_request.head.ref }}",
+              "sha": "${{ github.event.pull_request.head.sha }}",
+              "repo": "${{ github.repository }}"
+            }
+
+  trigger-on-merge:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Trigger post-merge tests
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.INTEGRATION_TEST_PAT }}
+          repository: ascoderu/iiab-lokole-tests
+          event-type: lokole-merged
+          client-payload: |
+            {
+              "branch": "${{ github.ref_name }}",
+              "sha": "${{ github.sha }}",
+              "repo": "${{ github.repository }}"
+            }
diff --git a/requirements-webapp.txt b/requirements-webapp.txt
index 6ff17966..461aa6da 100644
--- a/requirements-webapp.txt
+++ b/requirements-webapp.txt
@@ -1,3 +1,4 @@
+setuptools>=65.5.0,<73.0.0  # Required for pkg_resources in Python 3.12+ (no longer included by default). Upper bound because setuptools 73+ removed pkg_resources
 Babel==2.14.0  # 2.14.0+ required for Python 3.13 (removed cgi module dependency)
 Flask-BabelEx==0.9.4
 pytz  # Required by Flask-BabelEx (no longer a transitive dep of Babel 2.14+)
diff --git a/requirements.txt b/requirements.txt
index 1519698f..a5c116e9 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,7 @@
 Flask==2.2.1
 Flask-Cors==3.0.10
 Pillow==10.4.0  # 10.1.0+ required for Python 3.13 support
+setuptools>=65.5.0,<73.0.0  # Required for pkg_resources (gunicorn dependency). setuptools 73+ removed pkg_resources
 apache-libcloud==3.6.0
 applicationinsights==0.11.10
 beautifulsoup4==4.11.1