diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
new file mode 100644
index 000000000..e2bf049d8
--- /dev/null
+++ b/.github/workflows/autofix.yml
@@ -0,0 +1,38 @@
+# autofix.ci — auto-apply Prettier fixes to PRs (and main pushes).
+# Workflow name must remain exactly "autofix.ci" so the autofix.ci GitHub App
+# can securely identify this workflow. Install the app for this repository at
+# https://autofix.ci before expecting commits to land.
+name: autofix.ci # needed to securely identify the workflow
+
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: autofix-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  autofix:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node and dependencies
+        uses: ./.github/actions/setup-node-cached
+
+      - name: Format with Prettier
+        run: npm run format
+
+      - name: Apply autofix.ci patch
+        uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+        with:
+          commit-message: "style: apply Prettier format"
diff --git a/scripts/github-action-pins.mjs b/scripts/github-action-pins.mjs
index 605e3445e..cadcfdb89 100644
--- a/scripts/github-action-pins.mjs
+++ b/scripts/github-action-pins.mjs
@@ -33,6 +33,10 @@ const reviewedActionPins = new Map([
   ["peter-evans/create-or-update-comment", new Map([["e8674b075228eee787fea43ef493e45ece1004c9", "v5"]])],
   ["docker/setup-buildx-action", new Map([["bb05f3f5519dd87d3ba754cc423b652a5edd6d2c", "v4"]])],
   ["docker/build-push-action", new Map([["53b7df96c91f9c12dcc8a07bcb9ccacbed38856a", "v7"]])],
+  // Reviewed 2026-07-31: official autofix.ci action; tag v1.3.4 / moving v1 both
+  // resolve to this immutable commit (node24 runtime). Used only after local
+  // Prettier write; the action itself never receives write tokens in-workflow.
+  ["autofix-ci/action", new Map([["c5b2d67aa2274e7b5a18224e8171550871fc7e4a", "v1.3.4"]])],
 ]);
 
 const usesPattern = /^\s*(?:-\s*)?uses:\s*([^@\s]+)@([^\s#]+)(?:\s+#\s*(\S.*?))?\s*$/;
diff --git a/tests/github-action-pins.test.ts b/tests/github-action-pins.test.ts
index 588fcb689..8d505b12e 100644
--- a/tests/github-action-pins.test.ts
+++ b/tests/github-action-pins.test.ts
@@ -35,4 +35,10 @@ describe("GitHub Action pin validation", () => {
   it("allows repository-local actions", () => {
     expect(validateActionReference("        uses: ./.github/actions/example@v1")).toBeNull();
   });
+
+  it("accepts the reviewed autofix.ci action pin", () => {
+    expect(
+      validateActionReference("      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4"),
+    ).toBeNull();
+  });
 });