diff --git a/.github/workflows/reconcile.yml b/.github/workflows/reconcile.yml
new file mode 100644
index 0000000..ce4bb7a
--- /dev/null
+++ b/.github/workflows/reconcile.yml
@@ -0,0 +1,63 @@
+name: Reconcile derived versions
+
+# Close the 4.1b gap: editing omni/versions.yaml to a version that needs no new
+# build (a re-pin, rollback, or canary tweak) leaves the derived files stale,
+# because the talos-images build — which is what normally rewrites them — does
+# not run when nothing needs to be built.
+#
+# This workflow makes the snowed adjustment automatic. On a push to main that
+# touches omni/versions.yaml it runs the same drift checker in --write mode,
+# which rewrites oci-lab's machine classes and cluster template to match the
+# new pin. Hand-offs:
+#   * Already-built installer  -> --write succeeds, derived files committed here.
+#   * Not-yet-built installer  -> --write's installer_built() guard refuses with
+#     a clear message and the job fails. The operator then runs the talos-images
+#     build for that version (the only path that can ship a brand-new installer);
+#     that build rewrites the derived files and opens the upgrade PR as before.
+# This keeps build-then-pin for genuinely new versions (single writer, correct
+# ordering behind the build) while letting the gate reconcile re-pins.
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "omni/versions.yaml"
+
+permissions:
+  contents: write
+
+jobs:
+  reconcile:
+    name: Reconcile derived files from versions.yaml
+    runs-on: ubuntu-latest
+    concurrency:
+      group: reconcile-versions
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install PyYAML
+        run: pip install pyyaml --quiet
+
+      - name: Reconcile derived files
+        id: reconcile
+        run: |
+          python3 scripts/check-version-drift.py --write
+          status=$(git status --porcelain -- omni/machine-classes/ omni/cluster-templates/oci-lab.yaml)
+          if [ -z "${status}" ]; then
+            echo "No derived files needed updating."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit reconciled derived files
+        if: steps.reconcile.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add omni/machine-classes/ omni/cluster-templates/oci-lab.yaml
+          git commit -m "chore: reconcile derived files with omni/versions.yaml"
+          git push origin main