diff --git a/.github/workflows/update-cmake.yml b/.github/workflows/update-cmake.yml
new file mode 100644
index 00000000..19569e9e
--- /dev/null
+++ b/.github/workflows/update-cmake.yml
@@ -0,0 +1,52 @@
+name: Update CMake
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/update-cmake.yml'
+      - 'scripts/update_cmake_version.py'
+      - 'noxfile.py'
+  workflow_dispatch:
+  push:
+  schedule:
+    - cron: '0 6 * * *'  # "At 06:00 every day."
+
+jobs:
+  update-cmake:
+    name: Update CMake
+    if: github.repository_owner == 'scikit-build' || github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: wntrblm/nox@2024.04.15
+    - name: "Run update: bump CMake"
+      id: bump-cmake
+      run: |
+        nox --force-color -s bump
+        echo "version=$(nox -s cmake_version 2>/dev/null)" >> $GITHUB_OUTPUT
+    - run: echo "CMake version is ${{ steps.bump-cmake.outputs.version }}"
+
+    # we use this step to grab a Github App auth token, so that PRs generated by this workflow
+    # run the GHA tests.
+    - uses: actions/create-github-app-token@v1
+      id: app-token
+      if: github.ref == 'refs/heads/test-gh-app' && github.repository == 'scikit-build/cmake-python-distributions'
+      with:
+        app-id: ${{ secrets.SCIKIT_BUILD_BOT_APP_ID }}
+        private-key: ${{ secrets.SCIKIT_BUILD_BOT_APP_PRIVATE_KEY }}
+
+    - name: Create Pull Request
+      if: github.ref == 'refs/heads/test-gh-app' && github.repository == 'scikit-build/cmake-python-distributions'
+      uses: peter-evans/create-pull-request@v6
+      with:
+        commit-message: '[Bot] Update to CMake ${{ steps.bump-cmake.outputs.version }}'
+        title: '[Bot] Update to CMake ${{ steps.bump-cmake.outputs.version }}'
+        body: |
+          Created by update_cmake_version.py
+
+          PR generated by "Update CMake" [workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}).
+        branch: update-cmake-pr-test-gh-app
+        committer: "scikit-build-app-bot[bot] <173546081+scikit-build-app-bot[bot]@users.noreply.github.com>"
+        author: "scikit-build-app-bot[bot] <173546081+scikit-build-app-bot[bot]@users.noreply.github.com>"
+        token: ${{ steps.app-token.outputs.token }}
+        delete-branch: true
diff --git a/noxfile.py b/noxfile.py
index 838804d3..3f7605c3 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -157,6 +157,11 @@ def bump_openssl(session: nox.Session) -> None:
     _bump(session, "OpenSSL", "openssl/openssl", "3.0", "scripts/update_openssl_version.py", files)
 
 
+def _get_version() -> str:
+    txt = Path("pyproject.toml").read_text()
+    return next(iter(re.finditer(r'^version = "([\d\.]+)"$', txt, flags=re.MULTILINE))).group(1)
+
+
 @nox.session(venv_backend="none")
 def tag_release(session: nox.Session) -> None:
     """
@@ -164,7 +169,16 @@ def tag_release(session: nox.Session) -> None:
     """
 
     session.log("Run the following commands to make a release:")
-    txt = Path("pyproject.toml").read_text()
-    current_version = next(iter(re.finditer(r'^version = "([\d\.]+)"$', txt, flags=re.MULTILINE))).group(1)
+    current_version = _get_version()
     print(f"git tag --sign -m 'cmake-python-distributions {current_version}' {current_version} main")
     print(f"git push origin {current_version}")
+
+
+@nox.session(venv_backend="none")
+def cmake_version(session: nox.Session) -> None:  # noqa: ARG001
+    """
+    Print upstream cmake version.
+    """
+
+    current_version = _get_version()
+    print(".".join(current_version.split(".")[:3]))
diff --git a/pyproject.toml b/pyproject.toml
index d6cecff5..16263579 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "cmake"
-version = "3.29.6"
+version = "3.29.5.1"
 description = "CMake is an open-source, cross-platform family of tools designed to build, test and package software"
 keywords = ["CMake", "build", "c++", "fortran", "cross-platform", "cross-compilation"]
 readme = "README.rst"