diff --git a/.github/workflows/update_upstream.yml b/.github/workflows/update_upstream.yml
new file mode 100644
index 0000000..3b4f0c7
--- /dev/null
+++ b/.github/workflows/update_upstream.yml
@@ -0,0 +1,81 @@
+name: Update upstream tag
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 4 * * *'
+
+jobs:
+  update:
+    name: Check and update UPSTREAM_TAG
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Get latest upstream tag
+        id: upstream
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          latest=$(gh release view --repo astral-sh/python-build-standalone --json tagName --jq '.tagName')
+          echo "tag=$latest" >> "$GITHUB_OUTPUT"
+
+      - name: Get current tag from build.yml
+        id: current
+        run: |
+          current=$(grep 'UPSTREAM_TAG:' .github/workflows/build.yml | sed 's/.*UPSTREAM_TAG: *"\(.*\)".*/\1/')
+          echo "tag=$current" >> "$GITHUB_OUTPUT"
+
+      - name: Update build.yml if outdated
+        id: changes
+        run: |
+          latest="${{ steps.upstream.outputs.tag }}"
+          current="${{ steps.current.outputs.tag }}"
+
+          if [ "$latest" = "$current" ]; then
+            echo "Already up-to-date: $current"
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Updating UPSTREAM_TAG from $current to $latest"
+          sed -i "s/UPSTREAM_TAG: \"${current}\"/UPSTREAM_TAG: \"${latest}\"/" .github/workflows/build.yml
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          echo "latest=$latest" >> "$GITHUB_OUTPUT"
+          echo "current=$current" >> "$GITHUB_OUTPUT"
+
+      - name: Configure Git
+        if: steps.changes.outputs.has_changes == 'true'
+        run: |
+          git config user.name "Garden Linux Bot"
+          git config user.email "gardenlinux[bot]@users.noreply.github.com"
+
+      - name: Create branch and pull request
+        if: steps.changes.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          latest="${{ steps.changes.outputs.latest }}"
+          current="${{ steps.changes.outputs.current }}"
+          branch="update-upstream-tag-${latest}"
+
+          existing=$(gh pr list --base main --head "${branch}" --json number --jq '.[0].number' || echo "")
+          if [ -n "${existing}" ]; then
+            echo "PR #${existing} already exists for branch ${branch}, skipping."
+            exit 0
+          fi
+
+          git checkout -b "${branch}"
+          git add .github/workflows/build.yml
+          git commit -s -m "chore: update UPSTREAM_TAG from ${current} to ${latest}"
+          git push origin "${branch}" -f
+
+          gh pr create \
+            --base main \
+            --head "${branch}" \
+            --title "chore: update UPSTREAM_TAG from ${current} to ${latest}" \
+            --body "Automated update of \`UPSTREAM_TAG\` in \`build.yml\` from \`${current}\` to \`${latest}\` from [astral-sh/python-build-standalone](https://github.com/astral-sh/python-build-standalone/releases/tag/${latest})."