diff --git a/.github/workflows/update_iree_requirement_pins.yml b/.github/workflows/update_iree_requirement_pins.yml
index 36cfd35f4..18f428c3d 100644
--- a/.github/workflows/update_iree_requirement_pins.yml
+++ b/.github/workflows/update_iree_requirement_pins.yml
@@ -27,7 +27,7 @@ env:
 jobs:
   check-for-existing-branch:
     if: ${{ github.repository_owner == 'iree-org' || github.event_name != 'schedule' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     outputs:
       branch-exists: ${{ steps.check-exists.outputs.branch-exists }}
 
@@ -44,7 +44,7 @@ jobs:
 
   update-iree:
     needs: check-for-existing-branch
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: ${{ needs.check-for-existing-branch.outputs.branch-exists == 0 }}
 
     steps:
diff --git a/.github/workflows/update_llvm_sha.yml b/.github/workflows/update_llvm_sha.yml
new file mode 100644
index 000000000..bce56ed46
--- /dev/null
+++ b/.github/workflows/update_llvm_sha.yml
@@ -0,0 +1,119 @@
+# Copyright 2025 The IREE Authors
+#
+# Licensed under the Apache License v2.0 with LLVM Exceptions.
+# See https://llvm.org/LICENSE.txt for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+name: Update LLVM SHA
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch-name:
+        default: "integrates/llvm"
+        type: string
+        description: The branch name to put updates on
+  schedule:
+    # Weekly on Monday at 09:00 AM UTC
+    - cron: "0 9 * * 1"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  GIT_BRANCH_NAME: ${{ inputs.branch-name || 'integrates/llvm' }}
+  LLVM_REPO: https://github.com/llvm/llvm-project.git
+  LLVM_SHA_FILE: water/llvm-sha.txt
+
+jobs:
+  check-for-existing-branch:
+    if: ${{ github.repository_owner == 'iree-org' || github.event_name != 'schedule' }}
+    runs-on: ubuntu-24.04
+    outputs:
+      branch-exists: ${{ steps.check-exists.outputs.branch-exists }}
+
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - name: Check for existing integrate branch
+        id: check-exists
+        run: |
+          BRANCH_EXISTS=$(git ls-remote --exit-code --heads origin ${{ env.GIT_BRANCH_NAME }} | wc -l)
+          echo branch-exists=${BRANCH_EXISTS} >> "${GITHUB_OUTPUT}"
+          if [[ ${BRANCH_EXISTS} == 1 ]]; then
+            echo "Skipping update PR creation since the `${{ env.GIT_BRANCH_NAME }}` branch already exists." >> ${GITHUB_STEP_SUMMARY}
+          fi
+
+  update-llvm:
+    needs: check-for-existing-branch
+    runs-on: ubuntu-24.04
+    if: ${{ needs.check-for-existing-branch.outputs.branch-exists == 0 }}
+
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+
+      - name: Get current LLVM SHA
+        id: current-sha
+        run: |
+          CURRENT_SHA=$(cat ${{ env.LLVM_SHA_FILE }} | tr -d '[:space:]')
+          echo "current=${CURRENT_SHA}" >> "${GITHUB_OUTPUT}"
+          echo "Current LLVM SHA: ${CURRENT_SHA}" >> ${GITHUB_STEP_SUMMARY}
+
+      - name: Get latest LLVM SHA
+        id: latest-sha
+        run: |
+          LATEST_SHA=$(git ls-remote ${{ env.LLVM_REPO }} HEAD | awk '{print $1}')
+          echo "latest=${LATEST_SHA}" >> "${GITHUB_OUTPUT}"
+          echo "Latest LLVM SHA: ${LATEST_SHA}" >> ${GITHUB_STEP_SUMMARY}
+          # Compute web URL by stripping .git suffix
+          LLVM_WEB_URL="${{ env.LLVM_REPO }}"
+          LLVM_WEB_URL="${LLVM_WEB_URL%.git}"
+          echo "web_url=${LLVM_WEB_URL}" >> "${GITHUB_OUTPUT}"
+
+      - name: Update LLVM SHA file
+        if: ${{ steps.current-sha.outputs.current != steps.latest-sha.outputs.latest }}
+        run: |
+          echo "${{ steps.latest-sha.outputs.latest }}" > ${{ env.LLVM_SHA_FILE }}
+          echo "Updated ${{ env.LLVM_SHA_FILE }} to ${{ steps.latest-sha.outputs.latest }}" >> ${GITHUB_STEP_SUMMARY}
+
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        if: ${{ steps.current-sha.outputs.current != steps.latest-sha.outputs.latest && env.CREATE_PULL_REQUEST_TOKEN_APP_ID != '' && env.CREATE_PULL_REQUEST_TOKEN_APP_PRIVATE_KEY != '' }}
+        id: generate-token
+        with:
+          app-id: ${{ secrets.CREATE_PULL_REQUEST_TOKEN_APP_ID }}
+          private-key: ${{ secrets.CREATE_PULL_REQUEST_TOKEN_APP_PRIVATE_KEY }}
+        env:
+          CREATE_PULL_REQUEST_TOKEN_APP_ID: ${{ secrets.CREATE_PULL_REQUEST_TOKEN_APP_ID }}
+          CREATE_PULL_REQUEST_TOKEN_APP_PRIVATE_KEY: ${{ secrets.CREATE_PULL_REQUEST_TOKEN_APP_PRIVATE_KEY }}
+
+      - name: Create or update pull request
+        if: ${{ steps.current-sha.outputs.current != steps.latest-sha.outputs.latest }}
+        id: cpr
+        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
+        with:
+          token: ${{ steps.generate-token.outputs.token || secrets.GITHUB_TOKEN }}
+          base: main
+          branch: ${{ env.GIT_BRANCH_NAME }}
+          author: iree-pr-automator[bot] <iree-github-actions-bot@google.com>
+          signoff: true
+          title: "Bump LLVM to latest upstream commit"
+          body: |
+            This PR updates the LLVM commit SHA in `${{ env.LLVM_SHA_FILE }}` to the latest upstream commit.
+
+            **Current SHA:** `${{ steps.current-sha.outputs.current }}`
+            **Latest SHA:** `${{ steps.latest-sha.outputs.latest }}`
+
+            Commit diff: ${{ steps.latest-sha.outputs.web_url }}/compare/${{ steps.current-sha.outputs.current }}...${{ steps.latest-sha.outputs.latest }}
+
+            Auto-generated by GitHub Actions using [`.github/workflows/update_llvm_sha.yml`](https://github.com/${{ github.repository }}/blob/main/.github/workflows/update_llvm_sha.yml).
+          commit-message: "Bump LLVM to ${{ steps.latest-sha.outputs.latest }}"
+
+      - name: Write summary
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |
+          echo "Pull Request URL: ${{ steps.cpr.outputs.pull-request-url }}" >> ${GITHUB_STEP_SUMMARY}
+
+      - name: No update needed
+        if: ${{ steps.current-sha.outputs.current == steps.latest-sha.outputs.latest }}
+        run: |
+          echo "No update needed. LLVM is already at the latest commit: ${{ steps.current-sha.outputs.current }}" >> ${GITHUB_STEP_SUMMARY}