diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
new file mode 100644
index 0000000000..e7ede14fa8
--- /dev/null
+++ b/.github/workflows/automerge.yml
@@ -0,0 +1,24 @@
+on:
+  workflow_call:
+    secrets:
+      github-token:
+        required: true
+
+jobs:
+  # https://github.com/fastify/github-action-merge-dependabot
+  automerge:
+    name: Dependabot auto-merge
+    runs-on: ubuntu-20.04
+    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' }}
+
+    permissions:
+      pull-requests: write
+      contents: write
+
+    steps:
+      - uses: fastify/github-action-merge-dependabot@v3.0.0
+        with:
+          target: minor
+          github-token: ${{ secrets.github-token }}
+
+# vim:ft=yaml:et:ts=2:sw=2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000000..42b9b2ac19
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,29 @@
+name: "CI"
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "*.*.*"
+  pull_request:
+
+jobs:
+  docker:
+    uses: ./.github/workflows/docker-image.yml
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+
+  test:
+    uses: ./.github/workflows/test.yml
+    if: ${{ github.event_name == 'pull_request' }}
+
+  automerge:
+    uses: ./.github/workflows/automerge.yml
+    needs:
+      - docker
+      - test
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+
+# vim:ft=yaml:et:ts=2:sw=2
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index a824dcc1b5..2a931d1d97 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -6,12 +6,10 @@
 name: Publish Docker image
 
 on:
-  push:
-    branches:
-      - main
-    tags:
-      - "*.*.*"
-  pull_request:
+  workflow_call:
+    secrets:
+      github-token:
+        required: true
 
 env:
   REGISTRY: ghcr.io
@@ -19,7 +17,7 @@ env:
   TEST_IMAGE: plextraktsync:ci-test
 
 jobs:
-  build-and-push-image:
+  docker:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -51,7 +49,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.github-token }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7fb85ef6d4..a10f937fa6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,7 +1,7 @@
 name: Test
 
 on:
-  - pull_request
+  workflow_call:
 
 env:
   DEFAULT_PYTHON: 3.8
@@ -9,7 +9,6 @@ env:
 jobs:
   test:
     runs-on: ubuntu-latest
-    name: Test
     steps:
       - name: Check out source repository
         uses: actions/checkout@v4