diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 5ace460..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index e259464..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: CI
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-  workflow_dispatch:
-permissions:
-  contents: read
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - name: Run checks
-        run: nix flake check
diff --git a/.tangled/workflows/checks.yml b/.tangled/workflows/checks.yml
new file mode 100644
index 0000000..f39603d
--- /dev/null
+++ b/.tangled/workflows/checks.yml
@@ -0,0 +1,14 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+engine: "nixery"
+dependencies:
+  nixpkgs:
+    - nix
+steps:
+  - name: "Run checks"
+    command: |
+      set -euo pipefail
+      nix flake check
diff --git a/.tangled/workflows/update-flake-lock.yml b/.tangled/workflows/update-flake-lock.yml
new file mode 100644
index 0000000..5135685
--- /dev/null
+++ b/.tangled/workflows/update-flake-lock.yml
@@ -0,0 +1,25 @@
+when:
+  - event: ["manual"]
+engine: "nixery"
+dependencies:
+  nixpkgs:
+    - git
+    - nix
+steps:
+  - name: "Update flake.lock"
+    command: |
+      set -euo pipefail
+
+      git config user.name "spindle"
+      git config user.email "spindle@zezura.xyz"
+
+      nix flake update
+
+      if git diff --quiet -- flake.lock; then
+        echo "flake.lock is already up to date"
+        exit 0
+      fi
+
+      git add flake.lock
+      git commit -m "flake.lock: update"
+      git push origin "HEAD:${TANGLED_REPO_DEFAULT_BRANCH:-main}"