diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 64ce5d1..9bea47e 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -30,7 +30,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Auto-merge patch updates only
-        if: steps.meta.outputs.update-type == 'version-update:semver-patch'
+        if: steps.meta.outputs.update-type != 'version-update:semver-major'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
new file mode 100644
index 0000000..08b69b4
--- /dev/null
+++ b/.github/workflows/update-packages.yml
@@ -0,0 +1,46 @@
+name: Update Yarn packages
+
+on:
+  push:
+    branches: [ APM-6800-enable-automated-patches ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-packages:
+    name: Update Yarn lockfile
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+
+      - name: Update Yarn packages
+        working-directory: user-restricted-separate-auth-tutorials/nhs-login/php
+        run: |
+          corepack enable
+          yarn install
+          yarn upgrade #NOSONAR
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 #v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          sign-commits: true
+          branch: APM-6800-update-yarn
+          base: main
+          delete-branch: true
+          add-paths: |
+            user-restricted-separate-auth-tutorials/nhs-login/php/yarn.lock
+          commit-message: "chore: update Yarn packages"
+          title: "chore: update Yarn packages"
+          body: "Updates JavaScript dependencies in user-restricted-separate-auth-tutorials/nhs-login/php/yarn.lock."
+          labels: dependencies, javascript, yarn