diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
new file mode 100644
index 0000000..c066b48
--- /dev/null
+++ b/.github/workflows/dependabot-automerge.yml
@@ -0,0 +1,34 @@
+name: Dependabot compatible merge
+on:
+  workflow_run:
+    workflows: ["OSS policy", "Product workspace CI"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      number:
+        description: Dependabot PR number to evaluate
+        required: true
+        type: string
+permissions:
+  contents: read
+concurrency:
+  group: dependency-merge-${{ github.event.workflow_run.head_branch || github.event.inputs.number || github.run_id }}
+  cancel-in-progress: false
+jobs:
+  merge:
+    if: >-
+      vars.DEPENDABOT_AUTOMERGE_ENABLED == 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+      statuses: read
+      actions: read
+    steps:
+      - uses: zixcel/zixcel-repository-security/.github/actions/dependabot-merge@880b291dbb29a49bdafe5ae3305a47c978280550
+        with:
+          pull-request-number: ${{ github.event.inputs.number || '' }}