diff --git a/.gitattributes b/.gitattributes
index f9342b9..d3cbe7c 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,6 +4,7 @@
 /.eslintrc.json linguist-generated
 /.gitattributes linguist-generated
 /.github/pull_request_template.md linguist-generated
+/.github/workflows/auto-approve.yml linguist-generated
 /.github/workflows/build.yml linguist-generated
 /.github/workflows/pull-request-lint.yml linguist-generated
 /.github/workflows/release.yml linguist-generated
diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
new file mode 100644
index 0000000..5bae597
--- /dev/null
+++ b/.github/workflows/auto-approve.yml
@@ -0,0 +1,21 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+name: auto-approve
+on:
+  pull_request_target:
+    types:
+      - labeled
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+jobs:
+  approve:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    if: contains(github.event.pull_request.labels.*.name, 'auto-approve') && (github.event.pull_request.user.login == 'gn-devops-ci')
+    steps:
+      - uses: hmarr/auto-approve-action@v2.2.1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/upgrade-master.yml b/.github/workflows/upgrade-master.yml
index ecde3f3..7e7b90c 100644
--- a/.github/workflows/upgrade-master.yml
+++ b/.github/workflows/upgrade-master.yml
@@ -77,6 +77,7 @@ jobs:
             *Automatically created by projen via the "upgrade-master" workflow*
           branch: github-actions/upgrade-master
           title: "chore(deps): upgrade dependencies"
+          labels: auto-approve
           body: |-
             Upgrades project dependencies. See details in [workflow run].
 
diff --git a/.gitignore b/.gitignore
index 09d6994..8784261 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 !/.projen/deps.json
 !/.projen/files.json
 !/.github/workflows/pull-request-lint.yml
+!/.github/workflows/auto-approve.yml
 !/package.json
 !/LICENSE
 !/.npmignore
diff --git a/.projen/files.json b/.projen/files.json
index 7b62162..e7f8c4d 100644
--- a/.projen/files.json
+++ b/.projen/files.json
@@ -3,6 +3,7 @@
     ".eslintrc.json",
     ".gitattributes",
     ".github/pull_request_template.md",
+    ".github/workflows/auto-approve.yml",
     ".github/workflows/build.yml",
     ".github/workflows/pull-request-lint.yml",
     ".github/workflows/release.yml",
diff --git a/.projenrc.ts b/.projenrc.ts
index 514bcda..7d1ddb2 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -31,6 +31,12 @@ const project = new AwsCdkConstructLibrary({
   npmAccess: javascript.NpmAccess.PUBLIC,
   gitignore: ["cdk.out/"],
   prettier: true,
+  autoApproveOptions: {
+    allowedUsernames: ["gn-devops-ci"],
+    // must be different Token from PROJEN_GITHUB_TOKEN to approve PR
+    secret: "GITHUB_TOKEN",
+  },
+  autoApproveUpgrades: true,
 });
 
 // JSII sets this to `false` so we need to be compatible