diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8afb2721b..88d90417a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,12 +10,20 @@ on:
 
   workflow_dispatch:
 
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
       - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v6
         with:
@@ -65,6 +73,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       # Turborepo
       - name: Cache turbo build setup
@@ -114,6 +124,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       # Turborepo
       - name: Cache turbo build setup
@@ -159,6 +171,8 @@ jobs:
     if: ${{ !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.label, 'moeru-ai:i18n/')) }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       # Node.js
       - uses: pnpm/action-setup@v5
@@ -176,6 +190,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          ref: ${{ inputs.ref || github.ref }}
           fetch-depth: 0
       - uses: danielroe/provenance-action@main
         id: check
diff --git a/.github/workflows/update-nix-assets-hash.yaml b/.github/workflows/update-nix-assets-hash.yaml
index 365a7a971..1f22bdd12 100644
--- a/.github/workflows/update-nix-assets-hash.yaml
+++ b/.github/workflows/update-nix-assets-hash.yaml
@@ -11,10 +11,14 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   update:
+    if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork
     runs-on: ubuntu-latest
+    outputs:
+      has_changes: ${{ steps.changes.outputs.has_changes }}
     steps:
       # Why?
       #
@@ -26,6 +30,8 @@ jobs:
         uses: jlumbroso/free-disk-space@main
 
       - uses: actions/checkout@v6
+        with:
+          ref: main # Use main regardless of workflow_dispatch branch
 
       - uses: cachix/install-nix-action@v31
         with:
@@ -34,10 +40,43 @@ jobs:
       - name: Update Hash
         run: nix/update-assets-hash.sh
 
-      - name: Pull with rebase
-        run: git pull --rebase --autostash
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
 
-      - uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: 'chore(nix): update assets hash'
-          commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
+      - name: Create PR
+        if: steps.changes.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add nix/assets-hash.txt
+          git commit -m 'chore(nix): update assets hash'
+          git push -f origin HEAD:chore/update-nix-assets-hash
+
+          # Create PR if it doesn't already exist
+          existing_pr=$(gh pr list --head chore/update-nix-assets-hash --json number -q '.[0].number' 2>/dev/null || true)
+          if [ -z "$existing_pr" ]; then
+            gh pr create \
+              --base main \
+              --head chore/update-nix-assets-hash \
+              --title 'chore(nix): update assets hash' \
+              --body 'Auto-generated by CI to keep Nix asset hash up-to-date.'
+          fi
+
+          # Enable auto-merge so PR merges once checks pass
+          gh pr merge --squash --auto --delete-branch chore/update-nix-assets-hash
+
+  # Call CI as reusable workflow because bot PR doesn't trigger CI
+  ci:
+    needs: update
+    if: needs.update.outputs.has_changes == 'true'
+    uses: ./.github/workflows/ci.yml
+    with:
+      ref: chore/update-nix-assets-hash
diff --git a/.github/workflows/update-nix-pnpm-deps-hash.yaml b/.github/workflows/update-nix-pnpm-deps-hash.yaml
index 0d4502446..ca606ba65 100644
--- a/.github/workflows/update-nix-pnpm-deps-hash.yaml
+++ b/.github/workflows/update-nix-pnpm-deps-hash.yaml
@@ -10,10 +10,14 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   update:
+    if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork
     runs-on: ubuntu-latest
+    outputs:
+      has_changes: ${{ steps.changes.outputs.has_changes }}
     steps:
       # Why?
       #
@@ -25,6 +29,8 @@ jobs:
         uses: jlumbroso/free-disk-space@main
 
       - uses: actions/checkout@v6
+        with:
+          ref: main # Use main regardless of workflow_dispatch branch
 
       - uses: cachix/install-nix-action@v31
         with:
@@ -33,10 +39,43 @@ jobs:
       - name: Update Hash
         run: nix/update-pnpm-deps-hash.sh
 
-      - name: Pull with rebase
-        run: git pull --rebase --autostash
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
 
-      - uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: 'chore(nix): update pnpmDeps hash'
-          commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
+      - name: Create PR
+        if: steps.changes.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add nix/pnpm-deps-hash.txt
+          git commit -m 'chore(nix): update pnpmDeps hash'
+          git push -f origin HEAD:chore/update-nix-pnpm-deps-hash
+
+          # Create PR if it doesn't already exist
+          existing_pr=$(gh pr list --head chore/update-nix-pnpm-deps-hash --json number -q '.[0].number' 2>/dev/null || true)
+          if [ -z "$existing_pr" ]; then
+            gh pr create \
+              --base main \
+              --head chore/update-nix-pnpm-deps-hash \
+              --title 'chore(nix): update pnpmDeps hash' \
+              --body 'Auto-generated by CI to keep Nix pnpmDeps hash up-to-date.'
+          fi
+
+          # Enable auto-merge so PR merges once checks pass
+          gh pr merge --squash --auto --delete-branch chore/update-nix-pnpm-deps-hash
+
+  # Call CI as reusable workflow because bot PR doesn't trigger CI
+  ci:
+    needs: update
+    if: needs.update.outputs.has_changes == 'true'
+    uses: ./.github/workflows/ci.yml
+    with:
+      ref: chore/update-nix-pnpm-deps-hash