diff --git a/.github/workflows/roll-pinned-toolchain-versions.yml b/.github/workflows/roll-pinned-toolchain-versions.yml
new file mode 100644
index 0000000000..f4933b3547
--- /dev/null
+++ b/.github/workflows/roll-pinned-toolchain-versions.yml
@@ -0,0 +1,96 @@
+name: Roll pinned toolchain versions
+on:
+  schedule:
+    - cron: '29 15 * * *'
+  # TODO: Remove this before merging!!!
+  pull_request:
+
+# TODO: Once we confirm this works, try changing this to `read-all` to see if
+# the job still works.
+permissions: write-all
+
+jobs:
+  roll:
+    name: Roll pinned toolchain versions
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+        with:
+          ref: main
+        # TODO: Once we confirm this works, try uncommenting this to see if the
+        # job still works.
+        # with:
+        #   persist-credentials: false
+      - name: Calculate target nightly version
+        # Use yesterday's date (`-d '-1 day'`) so we're sure the nightly for that
+        # date has actually been published yet. This allows us to not worry
+        # about what time of day this job runs.
+        run: echo "ZC_TARGET_NIGHTLY=nightly-$(date -d '-1 day' +%Y-%m-%d)" >> $GITHUB_ENV
+      - name: Install Rust with ${{ env.ZC_TARGET_NIGHTLY }} toolchain
+        uses: dtolnay/rust-toolchain@00b49be78f40fba4e87296b2ead62868750bdd83 # stable
+        with:
+            toolchain: ${{ env.ZC_TARGET_NIGHTLY }}
+        # Install whatever the latest stable release is. This has the side
+        # effect of determining the latest stable release so that we can update
+        # `Cargo.toml`.
+      - name: Install Rust with stable toolchain
+        uses: dtolnay/rust-toolchain@00b49be78f40fba4e87296b2ead62868750bdd83 # stable
+        with:
+            toolchain: stable
+      - name: Update files
+        run: |
+          # Use `-x` because:
+          # - We never expect to look at the output of this job
+          # - We never expect this job to fail
+          #
+          # Thus, we'll only look at the output if it fails (so the verbosity
+          # isn't a problem in the success case), which should be unexpected, in
+          # which case we'll want to debug (so the verbosity is useful).
+          set -eox pipefail
+
+          function update-pinned-version {
+            VERSION_NAME="$1"
+            VERSION="$2"
+            # For nightly, this is the same as `$VERSION`. For stable, it's
+            # `stable` because `rustup` doesn't recognize that `x.y.z` refers to
+            # the same thing as `stable` even if they're the same toolchain.
+            VERSION_FOR_CARGO="$3"
+            FEATURES="$4"
+
+            # Confirm that `Cargo.toml` lists the pinned version in the expected
+            # format. This is a prerequisite for the subsequent `sed` command.
+            # If this fails, the preceding `set -e` will cause the script to
+            # exit with an error.
+            REGEX="^pinned-$VERSION_NAME = \"[a-z0-9\.-]*\"$"
+            grep "$REGEX" Cargo.toml >/dev/null
+            sed -i -e "s/$REGEX/pinned-$VERSION_NAME = \"$VERSION\"/" Cargo.toml
+
+            # Confirm that the update didn't bork `Cargo.toml`.
+            grep "$REGEX" Cargo.toml >/dev/null
+
+            # Update `.stderr` files as needed for the new version.
+            TRYBUILD=overwrite cargo "+$VERSION_FOR_CARGO" test $FEATURES --package zerocopy
+            TRYBUILD=overwrite cargo "+$VERSION_FOR_CARGO" test $FEATURES --package zerocopy-derive
+          }
+
+          # TODO: In order to support updating the stable release, we also need
+          # to update the versions listed in `**/tests/trybuild.rs`.
+
+          # STABLE_VERSION="$(cargo +stable version | sed -e 's/^cargo \([0-9\.]*\) .*/\1/')"
+          # update-pinned-version stable  "$STABLE_VERSION"    stable               '--features __internal_use_only_features_that_work_on_stable'
+          update-pinned-version nightly "$ZC_TARGET_NIGHTLY" "$ZC_TARGET_NIGHTLY"  --all-features
+
+          # Used as part of the branch name created by the "Submit PR" step.
+          # echo "ZC_TARGET_STABLE=STABLE_VERSION" >> $GITHUB_ENV
+
+      - name: Submit PR
+        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
+        with:
+          commit-message: "[ci] Roll pinned toolchains"
+          title: "[ci] Roll pinned toolchains"
+          branch: roll-pinned-toolchain-to-${{ env.ZC_TARGET_STABLE }}-and-${{ env.ZC_TARGET_NIGHTLY }}
+          # This allows the PR to be created by a user whom the Google CLA bot
+          # recognizes. Without this, PRs are authored by the `github-actions`
+          # account, which the CLA bot does not recognize.
+          token: ${{ secrets.ROLL_PINNED_TOOLCHAIN_TOKEN }}