diff --git a/.github/workflows/update-images.yml b/.github/workflows/update-images.yml
new file mode 100644
index 0000000..69dad8f
--- /dev/null
+++ b/.github/workflows/update-images.yml
@@ -0,0 +1,39 @@
+name: Update Images
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * MON'
+permissions:
+  contents: write
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v22
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Run update-images.py
+        run: |
+          scripts/update-images.py
+          cat debian.json | jq -S > debian/images.json
+          rm debian.json
+          if [[ -z $(git status -s) ]]; then
+            echo "Images up to date"
+            exit 0
+          else
+            git config user.name github-actions
+            git config user.email github-actions@github.com
+            git checkout -b update-images-$(date +%F)
+            git add debian/images.json
+            git commit -m "Update images: $(date +%F)"
+            git push
+          fi
+      - name: create pull request
+      - run: |
+          gh pr create -B main -H update-images-$(date +%F) \
+            --title 'Bump images.json' \
+            --body 'PR generated using scripts/update-images.py'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}