diff --git a/.github/workflows/ci.yml b/.github/workflows/check-deploy.yml
similarity index 89%
rename from .github/workflows/ci.yml
rename to .github/workflows/check-deploy.yml
index 488a790..e44bc06 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/check-deploy.yml
@@ -1,4 +1,4 @@
-name: "CI"
+name: "Check & Deploy"
 on:
   push:
     branches: [main]
@@ -14,7 +14,7 @@ jobs:
         with:
           name: sebastian-stork
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-      - run: nix flake check
+      - run: nix flake check --print-build-logs
   deploy:
     needs: check
     runs-on: ubuntu-latest
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
new file mode 100644
index 0000000..56f7930
--- /dev/null
+++ b/.github/workflows/update.yml
@@ -0,0 +1,20 @@
+name: "Update"
+on:
+  schedule:
+    - cron: "0 4 * * 1,3,6" # Mon, Wed, Sat at 04:00 UTC
+  workflow_dispatch:
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: experimental-features = nix-command flakes pipe-operators
+      - run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          nix flake update --commit-lock-file
+          git push