diff --git a/.github/workflows/dprint-update.yml b/.github/workflows/dprint-update.yml
new file mode 100644
index 0000000..cdf4c94
--- /dev/null
+++ b/.github/workflows/dprint-update.yml
@@ -0,0 +1,94 @@
+# .github/workflows/dprint-update.yml
+#
+# Pin dprint plugin manifest to a weekly cron + auto-open a PR if
+# anything drifts. See #236.
+#
+# Implementation:
+# - Mondays 09:00 UTC, run `npx dprint config update -y` which bumps
+#   every plugin in dprint.json to its latest version.
+# - Apply any formatting changes from new plugin rules via `npx dprint fmt`.
+# - If anything changed, open a PR via peter-evans/create-pull-request.
+# - If nothing changed, exit clean (no PR, no spam).
+name: dprint Plugin Updates
+
+on:
+  # Mondays 09:00 UTC. Anchored to a weekday morning so reviewers see it
+  # in their workday queue rather than over a weekend.
+  schedule:
+    - cron: "0 9 * * 1"
+  # Manual trigger for ad-hoc bumps or testing.
+  workflow_dispatch:
+
+# Cancel any in-flight runs if a new dispatch arrives. Manual +
+# cron can theoretically overlap if a manual `gh workflow run` is
+# triggered while the weekly cron job is still running.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+# Workflow-level default: read-only. Override at job level to allow
+# the specific write operations the PR-author needs.
+permissions: {}
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # commit + push to the chore/dprint-plugin-update branch
+      pull-requests: write # open the auto-PR
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # Pin to the locally-installed dprint (^0.54.0 in package.json devDeps)
+      # rather than curl-installing latest. Local pin = reproducible
+      # behavior matching what devs see; matches the convention used by
+      # lefthook's pre-commit dprint hook.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "20"
+          cache: "npm"
+      - name: Install dprint
+        run: npm install --no-save dprint@^0.54.0
+
+      # Bump every plugin in dprint.json to current latest.
+      # Output: deterministic diff to dprint.json. -y = non-interactive.
+      - name: Bump dprint plugins
+        run: npx dprint config update -y
+
+      # New plugin versions may have tighter formatting rules. Apply
+      # any drift they introduce to existing files so the diff in the
+      # PR shows just the version bump + rule conformance, not mixed
+      # noise.
+      - name: Apply formatting from new plugin rules
+        run: npx dprint fmt
+
+      # Detect drift across the whole tree. Empty tree = no PR.
+      - name: Detect drift
+        id: drift
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "Files changed:"
+            git status --short
+          fi
+
+      - name: Open PR
+        if: steps.drift.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@5e9f0e25d8c7b97b5d1de33e3308a46f7bb5f04ae # v6.1.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          title: "chore(deps): bump dprint plugins"
+          commit-message: "chore(deps): bump dprint plugins via dprint config update"
+          branch: chore/dprint-plugin-update
+          delete-branch: true
+          body: |
+            Weekly dprint plugin bump via `npx dprint config update -y` +
+            `npx dprint fmt`.
+
+            See #236 for the rationale and the schedule.
+
+            Auto-generated by `.github/workflows/dprint-update.yml`. Review
+            locally with `npm install --no-save dprint@^0.54.0 && npx dprint check .`
+            before merging.