diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000000..315fd1769f0
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+.git
+.github
+*.Dockerfile
+DOCKER_ASSESSMENT.md
+.mypy_cache
+.pytest_cache
+.coverage
+coverage.xml
+htmlcov/
+build/
+dist/
+*.egg-info/
+**/__pycache__/
+**/*.py[cod]
+docs/_build/
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index cb8e99f572d..92934e53d61 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -9,7 +9,12 @@ jobs:
   backport:
     runs-on: ubuntu-latest
     name: Backport label added
-    if: ${{ github.event.pull_request.user.type != 'Bot' }}
+    if: >-
+      ${{
+        github.event.pull_request.user.type != 'Bot'
+        && github.event.action == 'labeled'
+        && startsWith(github.event.label.name, 'backport')
+      }}
     steps:
       - uses: actions/github-script@v9
         with:
diff --git a/CHANGES/13331.contrib.rst b/CHANGES/13331.contrib.rst
new file mode 100644
index 00000000000..c856f98625a
--- /dev/null
+++ b/CHANGES/13331.contrib.rst
@@ -0,0 +1,3 @@
+Added a reproducible Docker build assessment and prevented backport label
+checks from failing on unrelated pull request events
+-- by :user:`piyushrajput0`.
diff --git a/CONTRIBUTORS.txt b/CONTRIBUTORS.txt
index d273f6b88d2..bc1f025ce46 100644
--- a/CONTRIBUTORS.txt
+++ b/CONTRIBUTORS.txt
@@ -325,6 +325,7 @@ Phebe Polk
 Philipp A.
 Pierre-Louis Peeters
 Pieter van Beek
+Piyush Kumar Singh
 Puneet Dixit
 Qiao Han
 Rafael Viotti
diff --git a/DOCKER_ASSESSMENT.md b/DOCKER_ASSESSMENT.md
new file mode 100644
index 00000000000..c7e1e762817
--- /dev/null
+++ b/DOCKER_ASSESSMENT.md
@@ -0,0 +1,81 @@
+# Docker Build Failure Assessment
+
+## Reconstructed original Dockerfile
+
+The build log prints this Dockerfile verbatim after `Using dockerfile:`. It is
+also saved as [original.Dockerfile](original.Dockerfile).
+
+```dockerfile
+FROM sweb.env.py.x86_64.3bb2f0e92d01ae3d2f2ae7:latest
+
+COPY ./setup_repo.sh /root/
+RUN sed -i -e 's/\r$//' /root/setup_repo.sh
+RUN /bin/bash /root/setup_repo.sh
+
+WORKDIR /testbed/
+```
+
+## Root cause analysis
+
+`Step 4/5 : RUN /bin/bash /root/setup_repo.sh` failed when its editable-install command ended with `ERROR: Failed to build 'file:///testbed' when getting requirements to build editable`, followed by `The command '/bin/sh -c /bin/bash /root/setup_repo.sh' returned a non-zero code: 1`. The setup script ran `pip install --no-cache-dir -e .` before `git submodule update --init --recursive`, so [setup.py](setup.py#L22-L29) deliberately exited because the llhttp submodule was absent; a later attempt also showed `cc1: fatal error: aiohttp/_websocket/mask.c: No such file or directory`, matching the generated C sources declared in [setup.py](setup.py#L57-L69). I assumed the explicitly logged five-instruction wrapper is the exact original Dockerfile; because its private `sweb.env` base and generated `setup_repo.sh` are not supplied, [fixed.Dockerfile](fixed.Dockerfile) uses an equivalent Python 3.11 base and aiohttp's supported `AIOHTTP_NO_EXTENSIONS` mode.
+
+## Fixed Dockerfile
+
+[fixed.Dockerfile](fixed.Dockerfile) builds a pure-Python wheel in a builder
+stage, installs only the wheel and its dependencies in a clean runtime stage,
+and runs as an unprivileged user. The Python base is digest-pinned, and
+[.dockerignore](.dockerignore) excludes Git metadata, caches, and build output.
+Keeping `AIOHTTP_NO_EXTENSIONS=1` in the runtime stage also makes
+[helpers.py](aiohttp/helpers.py#L86) select `reader_py.py` instead of the
+Windows checkout's flattened `reader_c.py` symlink placeholder.
+
+## Validation proof
+
+All commands were run from the repository root on 2026-08-06.
+
+### 1. Build
+
+```console
+PS> docker build -t assessment-fix -f fixed.Dockerfile .
+[+] Building 16.3s (12/12) FINISHED  docker:desktop-linux
+ => [internal] load build definition from fixed.Dockerfile          0.1s
+ => [internal] load metadata for docker.io/library/python:3.11-slim-bookworm  0.1s
+ => [internal] load .dockerignore                                   0.0s
+ => [internal] load build context                                   0.1s
+ => CACHED [builder 1/4] FROM docker.io/library/python:3.11-slim-bookworm  0.1s
+ => CACHED [builder 2/4] WORKDIR /src                               0.0s
+ => [builder 3/4] COPY . .                                          0.5s
+ => [builder 4/4] RUN python -m pip wheel --wheel-dir /wheels .     9.7s
+ => [stage-1 2/4] COPY --from=builder /wheels /wheels               0.1s
+ => [stage-1 3/4] RUN python -m pip install ...                     3.1s
+ => [stage-1 4/4] WORKDIR /app                                      0.2s
+ => exporting to image                                              1.4s
+ => => naming to docker.io/library/assessment-fix:latest            0.0s
+ => => unpacking to docker.io/library/assessment-fix:latest         0.3s
+```
+
+### 2. Verify image creation
+
+PowerShell's `Select-String` is the Windows equivalent of `grep` here.
+
+```console
+PS> docker image ls --format '{{.Repository}}:{{.Tag}} {{.Size}}' | Select-String 'assessment-fix'
+assessment-fix:latest 206MB
+```
+
+### 3. Basic functionality test
+
+```console
+PS> docker run --rm assessment-fix
+aiohttp 4.0.0a2.dev0 import OK
+```
+
+## Self-assessment
+
+The solution is grounded in both the exact log output and the repository's
+packaging checks, produces a reproducible multi-stage image, excludes
+unnecessary context, drops root privileges, and includes real build and runtime
+proof. Its main tradeoff is disabling aiohttp's optional C accelerators; a
+production-oriented follow-up could materialize the Git submodules and symlinks,
+generate all C sources with the repository's supported release process, and
+build an accelerated wheel while retaining the same clean runtime stage.
diff --git a/fixed.Dockerfile b/fixed.Dockerfile
new file mode 100644
index 00000000000..234b833c309
--- /dev/null
+++ b/fixed.Dockerfile
@@ -0,0 +1,28 @@
+FROM python:3.11-slim-bookworm@sha256:d29f48a31a8b408ed19272ca1e7b10ebae13b240a27e862d3d4217c528e2e0c3 AS builder
+
+ENV AIOHTTP_NO_EXTENSIONS=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /src
+COPY . .
+RUN python -m pip wheel --wheel-dir /wheels .
+
+FROM python:3.11-slim-bookworm@sha256:d29f48a31a8b408ed19272ca1e7b10ebae13b240a27e862d3d4217c528e2e0c3
+
+ENV AIOHTTP_NO_EXTENSIONS=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+COPY --from=builder /wheels /wheels
+RUN python -m pip install --no-cache-dir --no-index \
+        --find-links=/wheels /wheels/aiohttp-*.whl \
+    && rm -rf /wheels \
+    && groupadd --system aiohttp \
+    && useradd --system --gid aiohttp --no-create-home aiohttp
+
+USER aiohttp
+WORKDIR /app
+
+CMD ["python", "-c", "import aiohttp; print(f'aiohttp {aiohttp.__version__} import OK')"]
diff --git a/original.Dockerfile b/original.Dockerfile
new file mode 100644
index 00000000000..292b5e5a8d4
--- /dev/null
+++ b/original.Dockerfile
@@ -0,0 +1,7 @@
+FROM sweb.env.py.x86_64.3bb2f0e92d01ae3d2f2ae7:latest
+
+COPY ./setup_repo.sh /root/
+RUN sed -i -e 's/\r$//' /root/setup_repo.sh
+RUN /bin/bash /root/setup_repo.sh
+
+WORKDIR /testbed/