diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c0fdfc8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,29 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
+      - name: Type check
+        run: deno task check
+
+      - name: Lint
+        run: deno task lint
+
+      - name: Format check
+        run: deno fmt --check
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5d4f9cb..70d63c3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   publish_jsr:
+    if: github.repository == 'openstatusHQ/sdk-node'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -23,6 +24,7 @@ jobs:
       - name: Publish package
         run: deno publish
   publish_npm:
+    if: github.repository == 'openstatusHQ/sdk-node'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/regen.yml b/.github/workflows/regen.yml
new file mode 100644
index 0000000..9304ff3
--- /dev/null
+++ b/.github/workflows/regen.yml
@@ -0,0 +1,69 @@
+name: regen
+
+on:
+  schedule:
+    - cron: "0 8 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  regen:
+    name: regenerate from latest schema
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
+      # buf is not a dependency of this repo; deno task generate shells out to it
+      - uses: bufbuild/buf-action@v1
+        with:
+          setup_only: true
+
+      # buf.gen.yaml resolves buf.build/openstatus/api:main, so this diffs
+      # exactly when the schema moved
+      - name: Generate
+        run: deno task generate
+
+      # the committed tree is formatted; without this every run diffs the whole
+      # of src/gen on line wrapping alone
+      - name: Format generated code
+        run: deno fmt src/gen
+
+      - name: Type check
+        run: deno task check
+
+      # gated on a real diff — an unconditional bump would dirty the tree every
+      # run and open a weekly PR containing nothing but a version line
+      - name: Bump patch version
+        run: |
+          if git diff --quiet -- src/gen; then
+            echo "no schema change; skipping version bump"
+            exit 0
+          fi
+          cur=$(grep -oP '"version": "\K[^"]+' deno.json)
+          IFS=. read -r maj min pat <<< "$cur"
+          next="$maj.$min.$((pat + 1))"
+          # sed, not jq — jq re-serialises the whole file and dirties unrelated lines
+          sed -i -E "0,/\"version\": \"[^\"]+\"/s//\"version\": \"$next\"/" deno.json
+          echo "bumped $cur -> $next"
+
+      - name: Open PR if anything changed
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.SDK_BOT_TOKEN || github.token }}
+          branch: regen/schema
+          delete-branch: true
+          commit-message: "chore: regen src/gen from latest schema"
+          title: "chore: regen src/gen from latest schema"
+          body: |
+            Automated regen of `src/gen` from `buf.build/openstatus/api:main`.
+
+            Merging this only updates generated code — bump the package version
+            separately when cutting a release.
diff --git a/deno.json b/deno.json
index 3ef9bbc..b0fd45d 100644
--- a/deno.json
+++ b/deno.json
@@ -17,7 +17,11 @@
     "lint": "deno lint",
     "fmt": "deno fmt"
   },
+  "lint": {
+    "exclude": ["src/gen/"]
+  },
   "imports": {
+    "@deno/dnt": "jsr:@deno/dnt@0.42.3",
     "@bufbuild/protobuf": "npm:@bufbuild/protobuf@^2.11.0",
     "@connectrpc/connect": "npm:@connectrpc/connect@^2.1.1",
     "@connectrpc/connect-web": "npm:@connectrpc/connect-web@^2.1.1"
diff --git a/deno.lock b/deno.lock
index 1334196..1f14678 100644
--- a/deno.lock
+++ b/deno.lock
@@ -80,6 +80,7 @@
   },
   "workspace": {
     "dependencies": [
+      "jsr:@deno/dnt@0.42.3",
       "npm:@bufbuild/protobuf@^2.11.0",
       "npm:@connectrpc/connect-web@^2.1.1",
       "npm:@connectrpc/connect@^2.1.1"
diff --git a/scripts/build_npm.ts b/scripts/build_npm.ts
index 27ff346..aa57b7e 100644
--- a/scripts/build_npm.ts
+++ b/scripts/build_npm.ts
@@ -1,4 +1,5 @@
-import { build, emptyDir } from "jsr:@deno/dnt@0.42.3";
+import { build, emptyDir } from "@deno/dnt";
+import denoJson from "../deno.json" with { type: "json" };
 
 await emptyDir("./npm");
 
@@ -12,7 +13,7 @@ await build({
   package: {
     // package.json properties
     name: "@openstatus/sdk-node",
-    version: "0.2.0",
+    version: denoJson.version,
     description: "SDK for openstatus.",
     license: "MIT",
     repository: {