diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index a23c3f903..b9925f4dd 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -70,6 +70,11 @@ jobs:
           token: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
           ref: "master"
 
+      - name: Configure git
+        run: |
+          git config --global user.name cdrci
+          git config --global user.email opensource@coder.com
+
       - name: Fetch and reset master
         run: |
           git remote add upstream https://github.com/coder/code-server-aur.git
@@ -77,11 +82,6 @@ jobs:
           git reset --hard upstream/master
           git push --force
 
-      - name: Configure git
-        run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
-
       - name: Validate package
         uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
         with:
@@ -136,3 +136,32 @@ jobs:
           out-file-path: "release-packages"
 
       - run: npm run publish:docker
+
+  repo:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+      TAG: ${{ inputs.version || github.ref_name }}
+    needs: docker
+
+    steps:
+      - name: Set version to tag without leading v
+        run: |
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - run: ./ci/build/update-repo.sh
+
+      - name: Open PR
+        run: |
+          git config --global user.name cdrci
+          git config --global user.email opensource@coder.com
+          git checkout -b "helm/$VERSION"
+          git add .
+          git commit -m "Update to $VERSION"
+          git push -u origin "$(git branch --show)"
+          gh pr create \
+            --repo coder/code-server \
+            --body-file .cache/checklist \
+            --title "Update to $VERSION"
diff --git a/ci/build/update-repo.sh b/ci/build/update-repo.sh
new file mode 100755
index 000000000..bc8bf522d
--- /dev/null
+++ b/ci/build/update-repo.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+function update_helm() {
+  local current
+  current=$(yq .version ci/helm-chart/Chart.yaml)
+  local next
+  next=$(semver "$current" -i minor)
+  echo "Bumping version from $current to $next..."
+  sed -i.bak "s/^version: $current\$/version: $next/" ci/helm-chart/Chart.yaml
+
+  echo "Setting app version and image to $version..."
+  sed -i.bak "s/^appVersion: .\+\$/appVersion: $version/" ci/helm-chart/Chart.yaml
+  sed -i.bak "s/^  tag: .\+\$/  tag: '$version'/" ci/helm-chart/values.yaml
+}
+
+function update_changelog() {
+  local date
+  date=$(printf '%(%Y-%m-%d)T\n' -1)
+  local link="https://github.com/coder/code-server/releases/tag/v$version"
+  sed -i.bak "s|## Unreleased|## Unreleased\n\n## [$version]($link) - $date|" CHANGELOG.md
+}
+
+function main() {
+  cd "$(dirname "${0}")/../.."
+
+  source ./ci/lib.sh
+
+  local version=${VERSION:-$(git describe --tags)}
+  version="${version#v}"
+
+  declare -a steps
+
+  steps+=(
+    "Update Helm chart" "update_helm"
+    "Update changelog" "update_changelog"
+  )
+
+  run-steps "${steps[@]}"
+
+  # This step is always manual.
+  echo "- [ ] https://github.com/coder/code-server-aur/pulls" >> .cache/checklist
+}
+
+main "$@"
diff --git a/ci/build/update-vscode.sh b/ci/build/update-vscode.sh
index 7b4004cbf..828924b55 100755
--- a/ci/build/update-vscode.sh
+++ b/ci/build/update-vscode.sh
@@ -2,17 +2,6 @@
 
 set -Eeuo pipefail
 
-function quiet() {
-  "$@" >/dev/null
-}
-
-function indent() {
-  local count=2
-  local space
-  space=$(printf "%${count}s")
-  sed "s/^/$space| /g"
-}
-
 function unapply_patches() {
   local -i exit_code=0
   quiet quilt pop -af || exit_code=$?
@@ -110,31 +99,6 @@ function update_csp() {
   fi
 }
 
-function run() {
-  local -i failed=0
-  rm -f .cache/checklist
-  while (( $# )) ; do
-    local name=$1 ; shift
-    local fn=$1 ; shift
-    # Only run if an earlier step has not failed.
-    if [[ $failed == 0 ]] ; then
-      echo "$name..."
-      if $fn | indent ; then
-        echo "- [X] $name" >> .cache/checklist
-      else
-        ((failed++))
-      fi
-    fi
-    # For all failed steps, write out an empty checkbox.
-    if [[ $failed != 0 ]] ; then
-      echo "- [ ] $name" >> .cache/checklist
-    fi
-  done
-  if [[ $failed != 0 ]] ; then
-    return 1
-  fi
-}
-
 function add_changelog() {
   local file=CHANGELOG.md
   if grep --quiet "Code $target_vscode_version" "$file" ; then
@@ -181,7 +145,7 @@ function main() {
     "Add changelog note" "add_changelog"
   )
 
-  run "${steps[@]}"
+  run-steps "${steps[@]}"
 
   # This step is always manual.
   echo "- [ ] Verify changelog" >> .cache/checklist
diff --git a/ci/lib.sh b/ci/lib.sh
index 71a875c69..d6de76ce5 100755
--- a/ci/lib.sh
+++ b/ci/lib.sh
@@ -78,6 +78,42 @@ nodeArch() {
   echo "$cpu"
 }
 
+run-steps() {
+  local -i failed=0
+  rm -f .cache/checklist
+  while (( $# )) ; do
+    local name=$1 ; shift
+    local fn=$1 ; shift
+    # Only run if an earlier step has not failed.
+    if [[ $failed == 0 ]] ; then
+      echo "$name..."
+      if $fn | indent ; then
+        echo "- [X] $name" >> .cache/checklist
+      else
+        ((failed++))
+      fi
+    fi
+    # For all failed steps, write out an empty checkbox.
+    if [[ $failed != 0 ]] ; then
+      echo "- [ ] $name" >> .cache/checklist
+    fi
+  done
+  if [[ $failed != 0 ]] ; then
+    return 1
+  fi
+}
+
+quiet() {
+  "$@" >/dev/null
+}
+
+indent() {
+  local count=2
+  local space
+  space=$(printf "%${count}s")
+  sed "s/^/$space| /g"
+}
+
 # See gulpfile.reh.ts for available targets.
 if [[ ! ${VSCODE_TARGET-} ]]; then
   VSCODE_TARGET="$(nodeOS)-$(nodeArch)"