diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 2e8ef4a..8eeb27c 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -60,3 +60,15 @@ jobs:
           signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
       - name: Build flake check
         run: nix build --print-build-logs './nix/develop#${{ matrix.attr }}'
+
+  ci-gate:
+    name: ci-gate
+    needs: [nix-flake-check, nix-matrix, nix-build]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail unless every job succeeded
+        run: |
+          [ "${{ needs.nix-flake-check.result }}" = success ]
+          [ "${{ needs.nix-matrix.result }}" = success ]
+          [ "${{ needs.nix-build.result }}" = success ]
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 73bb9ae..c9e3de4 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -51,12 +51,15 @@ jobs:
       run: git push --set-upstream origin update --force
     - name: Create pull request
       run: |
+        body="Automated Nix flake and Cargo dependency updates."
         gh pr create \
           --base main \
           --head update \
           --title "Automated update" \
-          --body "Automated Nix flake and Cargo dependency updates." || \
+          --label auto-update \
+          --body "$body" || \
         gh pr edit update \
-          --body "Automated Nix flake and Cargo dependency updates."
+          --add-label auto-update \
+          --body "$body"
       env:
         GH_TOKEN: '${{ secrets.PAT_FOR_AUTOMATED_UPDATE }}'
diff --git a/.mergify.yml b/.mergify.yml
new file mode 100644
index 0000000..2110d09
--- /dev/null
+++ b/.mergify.yml
@@ -0,0 +1,13 @@
+# yaml-language-server: $schema=https://docs.mergify.com/mergify-configuration-schema.json
+pull_request_rules:
+  - name: Merge automated update after every check
+    conditions:
+      - label = auto-update
+      - base = main
+      # fast-forward only lands on an up-to-date main.
+      - "#commits-behind = 0"
+      - check-success = ci-gate
+      - "#check-failure = 0"
+    actions:
+      merge:
+        method: fast-forward