There's a post build action to label a Jenkins build. There's already a configuration option to only do this if the build is successful, there should also be an option to only update the label if it is not already locked.