diff --git a/.github/workflows/copyright_year.yml b/.github/workflows/copyright_year.yml
new file mode 100644
index 0000000000..85994ee2d2
--- /dev/null
+++ b/.github/workflows/copyright_year.yml
@@ -0,0 +1,84 @@
+name: Copyright year
+
+# Keeps the copyright year in the help output (`--help`) current.
+#
+# The year is a plain literal in configure.ac, updated by a reviewed pull
+# request -- this workflow only opens that pull request, it never pushes to a
+# release branch. Scheduled runs act on the default branch; to refresh a
+# maintained branch, dispatch this workflow with that branch selected and the
+# pull request will target it.
+
+on:
+  schedule:
+    # 03:00 UTC on January 2nd, by which point the year has rolled over
+    # in every timezone.
+    - cron: '0 3 2 1 *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump_copyright_year:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update the copyright year
+        id: bump
+        run: |
+          set -eu
+
+          year=$(date -u +%Y)
+          base=$GITHUB_REF_NAME
+
+          {
+            echo "year=$year"
+            echo "branch=copyright-year-${base//\//-}-$year"
+          } >> "$GITHUB_OUTPUT"
+
+          # Fail loudly rather than silently doing nothing if the define is
+          # ever renamed or reformatted -- a silent no-op here is exactly how
+          # the year went three releases without being updated.
+          if ! grep -qE '^AC_DEFINE\(CF_COPYRIGHT, "[0-9]{4} Northern\.tech AS"' configure.ac; then
+            echo "::error file=configure.ac::CF_COPYRIGHT define not found in the expected form; update this workflow"
+            exit 1
+          fi
+
+          sed -i -E \
+            "s/^(AC_DEFINE\(CF_COPYRIGHT, \")[0-9]{4}( Northern\.tech AS\")/\1$year\2/" \
+            configure.ac
+
+          if git diff --quiet -- configure.ac; then
+            echo "Copyright year is already $year, nothing to do."
+            exit 0
+          fi
+
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+
+      # sign-commits creates the commit through the GitHub API so it is signed
+      # by GitHub and shows as verified; it also ignores the committer and
+      # author inputs, so there is no bot identity to configure here.
+      - name: Open a pull request
+        if: steps.bump.outputs.changed == 'true'
+        uses: cfengine/create-pull-request@v7
+        with:
+          base: ${{ github.ref_name }}
+          branch: ${{ steps.bump.outputs.branch }}
+          delete-branch: true
+          sign-commits: true
+          add-paths: configure.ac
+          commit-message: |
+            Updated help menu copyright year to ${{ steps.bump.outputs.year }}
+
+            Opened automatically by .github/workflows/copyright_year.yml.
+
+            Changelog: none
+          title: Updated help menu copyright year to ${{ steps.bump.outputs.year }}
+          body: |
+            The copyright year shown by `--help` is a literal in `configure.ac`; this updates it to ${{ steps.bump.outputs.year }}.
+
+            Opened automatically by [.github/workflows/copyright_year.yml](.github/workflows/copyright_year.yml).
+
+            Pull requests opened with `GITHUB_TOKEN` do not trigger other workflows, so CI has not started on its own -- comment `@cf-bottom jenkins, please` to run it.