diff --git a/.github/workflows/auto-merge-compatibility-docs.yml b/.github/workflows/auto-merge-compatibility-docs.yml
new file mode 100644
index 00000000..cd92c5d8
--- /dev/null
+++ b/.github/workflows/auto-merge-compatibility-docs.yml
@@ -0,0 +1,35 @@
+---
+# yamllint disable rule:truthy rule:line-length
+name: "Auto-merge compatibility matrix updates"
+
+# The compatibility matrix PR is generated by the Infrahub release pipeline and
+# contains nothing but regenerated docs, so it merges itself once CI is green.
+# Waiting for CI is enforced by the `ci-gate` required status check on `stable`,
+# not by this workflow.
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      # Auto-merge cannot be enabled on a draft, so re-evaluate on the transition out of one.
+      - ready_for_review
+
+jobs:
+  enable-auto-merge:
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'automated/update-compatibility-docs' &&
+      github.event.pull_request.base.ref == 'stable' &&
+      github.event.pull_request.user.login == 'opsmill-bot' &&
+      github.event.pull_request.draft == false
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 5
+    steps:
+      - name: "Enable auto-merge"
+        # Authenticate as opsmill-bot: it is the identity allowed to bypass the
+        # approval requirement on `stable`, and auto-merge merges as whoever enabled it.
+        env:
+          GH_TOKEN: ${{ secrets.GH_UPDATE_PACKAGE_OTTO }}
+        run: gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57555d57..c8073f6d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -422,3 +422,31 @@ jobs:
   #         codecov --flags integration-tests
   #       env:
   #         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  # ------------------------------------------ Gate  ------------------------------------------
+  # Single rollup check, so branch protection can require CI without naming every
+  # job (several are conditional, and unit-tests fans out over a moving matrix).
+  ci-gate:
+    name: ci-gate
+    if: always()
+    needs:
+      - prepare-environment
+      - files-changed
+      - yaml-lint
+      - python-lint
+      - markdown-lint
+      - action-lint
+      - uv-lock-check
+      - documentation
+      - validate-generated-documentation
+      - validate-documentation-style
+      - unit-tests
+      - integration-tests-latest-infrahub
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 5
+    steps:
+      - name: "Fail if any job did not succeed or skip"
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "One or more CI jobs failed or were cancelled."
+          exit 1