diff --git a/.github/workflows/sync-auto-merge-prs.yml b/.github/workflows/sync-auto-merge-prs.yml
new file mode 100644
index 0000000000..e06f102058
--- /dev/null
+++ b/.github/workflows/sync-auto-merge-prs.yml
@@ -0,0 +1,41 @@
+name: Sync auto-merge PRs with develop
+
+on:
+  schedule:
+    - cron: '0 0-5 * * *'
+  workflow_dispatch:
+
+jobs:
+  sync-one-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Find and sync one behind auto-merge PR
+        env:
+          GH_TOKEN: ${{ secrets.PR_SYNC_PAT }}
+        run: |
+          PR_LIST=$(gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --base develop \
+            --state open \
+            --json number,title,autoMergeRequest,mergeStateStatus)
+
+          BEHIND=$(echo "$PR_LIST" | jq '[.[] | select(
+            .autoMergeRequest != null and
+            .mergeStateStatus == "BEHIND"
+          )]')
+
+          COUNT=$(echo "$BEHIND" | jq 'length')
+          echo "Found $COUNT auto-merge PR(s) behind develop"
+
+          if [ "$COUNT" -eq 0 ]; then
+            echo "Nothing to sync."
+            exit 0
+          fi
+
+          INDEX=$((RANDOM % COUNT))
+          PR_NUMBER=$(echo "$BEHIND" | jq --argjson i "$INDEX" '.[$i].number')
+          PR_TITLE=$(echo "$BEHIND"  | jq -r --argjson i "$INDEX" '.[$i].title')
+
+          echo "Selected PR #$PR_NUMBER: $PR_TITLE"
+          gh pr update-branch "$PR_NUMBER" --repo "$GITHUB_REPOSITORY"
+          echo "Branch updated."
diff --git a/.github/workflows/update-prs-with-develop.yml b/.github/workflows/update-prs-with-develop.yml
deleted file mode 100644
index 587db53f49..0000000000
--- a/.github/workflows/update-prs-with-develop.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Update PRs with develop
-
-on:
-  push:
-    branches:
-      - develop
-
-jobs:
-  sync-prs:
-    # Disabled until we can push with a PAT that has workflow scope; otherwise CI stays in "Waiting".
-    if: ${{ false }}
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure git user
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Merge develop into all open non-Dependabot PRs
-        # TODO: Re-enable once we replace the default GITHUB_TOKEN with a PAT that has repo+workflow scopes
-        # so that downstream PR checks trigger automatically after the bot pushes merge commits.
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Get all open PRs targeting develop, excluding Dependabot
-          prs=$(gh pr list --state open --base develop --limit 100 --json number,author --jq '.[] | select(.author.is_bot != true) | .number')
-
-          for pr in $prs; do
-            echo "Processing PR #$pr"
-            gh pr checkout $pr
-            git fetch origin develop
-
-            # Attempt merge
-            if git merge --no-edit origin/develop; then
-              echo "PR #$pr merged successfully. Pushing changes..."
-              git push
-            else
-              echo "Conflict in PR #$pr. Merge aborted."
-              git merge --abort
-              # Optional: Notify author
-              gh pr comment $pr --body "⚠️ Automatic merge of \`develop\` into this PR failed due to conflicts. Please resolve the conflicts and update your branch."
-            fi
-          done