diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index d1050bf0b..50b83da44 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,4 +1,3 @@
 *                       @CustomResourceDefinition/core-maintainers @CustomResourceDefinition/github-administrators
-*.mod *.sum             @CustomResourceDefinition/core-maintainers @CustomResourceDefinition/github-administrators @app/crd-automation
-.github                 @CustomResourceDefinition/github-administrators @app/crd-automation
+.github                 @CustomResourceDefinition/github-administrators
 configuration.yaml      @CustomResourceDefinition/core-maintainers @CustomResourceDefinition/github-administrators @CustomResourceDefinition/sources-maintainers
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index a8facb2dc..b14a54788 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -17,12 +17,12 @@ jobs:
       - run: make test
 
   auto-merge:
-    name: Automatically merge dependabot PRs
+    name: Automatically merge bot PRs
     needs: test
     runs-on: ubuntu-latest
     steps:
       - name: Create token
-        if: github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'
+        if: (github.actor == 'dependabot[bot]' || github.actor == 'crd-automation[bot]') && github.event_name == 'pull_request'
         id: app-token
         uses: actions/create-github-app-token@v2
         with:
@@ -31,7 +31,7 @@ jobs:
           owner: ${{ github.repository_owner }}
           repositories: catalog
       - name: Merge PR
-        if: github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'
+        if: (github.actor == 'dependabot[bot]' || github.actor == 'crd-automation[bot]') && github.event_name == 'pull_request'
         run: gh pr merge --admin --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/upgrade-go.yaml b/.github/workflows/upgrade-go.yaml
new file mode 100644
index 000000000..714d1bb8a
--- /dev/null
+++ b/.github/workflows/upgrade-go.yaml
@@ -0,0 +1,63 @@
+name: Upgrade Go Version
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 8 * * 1"
+
+jobs:
+  upgrade-go:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Create token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: catalog
+
+      - name: Check for Go updates
+        id: check
+        run: |
+          CURRENT=$(grep "^go " go.mod | awk '{print $2}')
+          LATEST=$(go list -m -f '{{.Version}}' go@latest)
+          {
+            echo "latest=$LATEST"
+            echo "needs_update=false"
+            [ "$CURRENT" != "$LATEST" ] && echo "needs_update=true" || true
+          } >> $GITHUB_OUTPUT
+
+      - name: Update Go version
+        if: steps.check.outputs.needs_update == 'true'
+        env:
+          GO_VERSION: ${{ steps.check.outputs.latest }}
+        run: |
+          go mod edit -go=$GO_VERSION
+          go mod tidy
+          {
+              grep -v "^golang " .tool-versions || true
+              echo "golang $GO_VERSION"
+          } > .tool-versions.tmp
+          mv .tool-versions.tmp .tool-versions
+
+      - name: Create Pull Request
+        if: steps.check.outputs.needs_update == 'true'
+        uses: peter-evans/create-pull-request@v8
+        with:
+          author: crd-automation[bot] <crd-automation[bot]@users.noreply.github.com>
+          title: "chore: upgrade Go to ${{ steps.check.outputs.latest }}"
+          commit-message: "chore: upgrade Go to ${{ steps.check.outputs.latest }}"
+          branch: chore/upgrade-go-${{ steps.check.outputs.latest }}
+          add-paths: |
+            .tool-versions
+            go.mod
+            go.sum
+          labels: go
+          token: ${{ steps.app-token.outputs.token }}