diff --git a/.github/workflows/automatic-release-keys.yml b/.github/workflows/automatic-release-keys.yml
new file mode 100644
index 000000000..e8398b05b
--- /dev/null
+++ b/.github/workflows/automatic-release-keys.yml
@@ -0,0 +1,33 @@
+name: Automatically update Node.js team release keys
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 12 * * 1'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'nodejs'
+    permissions:
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run automation script
+        run: ./update-keys.sh
+
+      - name: Create update PR
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GH_API_TOKEN }}
+          author: 'Node.js GitHub Bot <nodejs-github-bot@users.noreply.github.com>'
+          branch: keys-branch
+          base: main
+          commit-message: 'chore: Node.js release key sync'
+          title: 'chore: Node.js release key sync'
+          body: Open based on changes from `update-keys.sh`. For details on whose key is changing, look at https://github.com/nodejs/node#release-keys
+          delete-branch: true
+          team-reviewers: |
+            nodejs/docker