diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index ec47db5e55..f92139e0be 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -8,19 +8,19 @@ on:
 
 jobs:
   sync:
-    if: github.event.pull_request.merged == true
+    if: github.event.pull_request.merged == true && !contains(github.event.pull_request.labels.*.name, 'nosync')
     runs-on: ubuntu-latest
     steps:
-      - name: Install SSH key
-        run: |
-          mkdir -p ${{ runner.temp }}
-          echo "${{ secrets.SSH_SIGNING_KEY }}" > ${{ runner.temp }}/signing_key
-          chmod 0700 ${{ runner.temp }}/signing_key
       - name: Checkout
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
           ssh-key: ${{ secrets.SSH_AUTHENTICATION_KEY }}
+      - name: Install SSH key
+        run: |
+          mkdir -p ${{ runner.temp }}
+          echo "${{ secrets.SSH_SIGNING_KEY }}" > ${{ runner.temp }}/signing_key
+          chmod 0700 ${{ runner.temp }}/signing_key
       - name: Setup Git
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
@@ -29,11 +29,10 @@ jobs:
           git config gpg.format "ssh"
           git config user.signingkey "${{ runner.temp }}/signing_key"
       - name: Download patches
-        run: |
-          curl https://github.com/terrapkg/packages/pull/${{ github.event.pull_request.number }}.patch > pr.patch
+        run: curl https://github.com/terrapkg/packages/pull/${{ github.event.pull_request.number }}.patch > pr.patch
       - name: Apply patches
         run: |
           git checkout f38
-          git am --keep-cr --signoff < pr.patch
+          git am -S --keep-cr --signoff < pr.patch
       - name: Push
-        run: git push origin -u --all
+        run: git push -u origin --all