diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
index ca1e5c9..1c64ee5 100644
--- a/.gds/bundle.lock.yaml
+++ b/.gds/bundle.lock.yaml
@@ -5,14 +5,14 @@ bundle:
   version: "0.4.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:2148c6e284f49ee4f903a277dd9e66d00fa04f702849df0d6e1f27fdc22c844f"
-  digest: "sha256:01148d0f9d071a83bf0b8c2b261c338a1cef85db495ad6b56a916bcaaccb13f2"
+  source_tree_digest: "sha256:59713449410be6fb1e4868983acd2874363a2e95abc0bf87dd3df3b193bda202"
+  digest: "sha256:95d77c5b53817b4e4c4642b8eb92e37ec82ba257d3ab7998e858e6b10938a6df"
 
 projection:
-  input_digest: "sha256:e5ca5145204bf1c61795506dfd727628799d1439721cbb55b34bd8aeafbe4181"
-  output_digest: "sha256:e6fd68d489859d61b1bbd171f76ab9803f2daee0a36a0fe57b4da83fb51c13b8"
+  input_digest: "sha256:5f450c2292813f1e3b60cae7aa46dda65b2e0649177eb489eba2f2e03f6ca160"
+  output_digest: "sha256:7b75694567dada8cb9ed0c63e76b4af53deffd077e9c084619252fb7f142dc43"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:41814b84b1d1855dc66684d3f036d88f60b5b5c653f63bd8f05ce31a7ff071ea"
+      digest: "sha256:3c6ff0a8ab2d4da341dd5393c6d22ea18c8fc5386cde3adf094a1cd9124050f8"
diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
index 1c8a0ab..2a924c7 100644
--- a/.github/workflows/gds-ci.yml
+++ b/.github/workflows/gds-ci.yml
@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.4.0-dev
-# source-tree-digest: sha256:2148c6e284f49ee4f903a277dd9e66d00fa04f702849df0d6e1f27fdc22c844f
-# input-digest: sha256:e5ca5145204bf1c61795506dfd727628799d1439721cbb55b34bd8aeafbe4181
+# source-tree-digest: sha256:59713449410be6fb1e4868983acd2874363a2e95abc0bf87dd3df3b193bda202
+# input-digest: sha256:5f450c2292813f1e3b60cae7aa46dda65b2e0649177eb489eba2f2e03f6ca160
 # output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49
 # edit-source:
 #   - .gds/repository.yaml
diff --git a/core/cli/root_test.go b/core/cli/root_test.go
index d9930c9..254e3f7 100644
--- a/core/cli/root_test.go
+++ b/core/cli/root_test.go
@@ -251,6 +251,9 @@ func TestGenerateRepositoryConsumesVerifiedReleasedBundle(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	anchor = []byte(strings.Replace(
+		string(anchor), "    - \"github-device-sync\"\n", "    - \"github-actions\"\n", 1,
+	))
 	if err := os.WriteFile(filepath.Join(target, ".gds", "repository.yaml"), anchor, 0o644); err != nil {
 		t.Fatal(err)
 	}
diff --git a/policies/repositories/github-actions.yaml b/policies/repositories/github-actions.yaml
new file mode 100644
index 0000000..e6ad85e
--- /dev/null
+++ b/policies/repositories/github-actions.yaml
@@ -0,0 +1,25 @@
+schema_version: 1
+
+policy:
+  id: "github-actions"
+  tier: "repository"
+  priority: 100
+  distribution: "public"
+
+apply:
+  github:
+    merge:
+      # CONTRIBUTING.md requires audit and rollout commits to retain their
+      # individual identities when a pull request reaches main.
+      allow_merge_commit:
+        management: "managed"
+        value: true
+      allow_squash_merge:
+        management: "managed"
+        value: false
+      allow_rebase_merge:
+        management: "managed"
+        value: false
+      allow_auto_merge:
+        management: "managed"
+        value: true