diff --git a/.github/workflows/submodule_update.yml b/.github/workflows/submodule_update.yml
new file mode 100644
index 0000000000..84b85da675
--- /dev/null
+++ b/.github/workflows/submodule_update.yml
@@ -0,0 +1,41 @@
+name: submodule_update
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Mondays at 2pm UTC (9am EST)
+    - cron: "0 14 * * 1"
+
+jobs:
+  submodule_update:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout source
+      uses: actions/checkout@v2
+      with:
+        submodules: true
+    - name: Fetch latest submodule
+      run: |
+        git submodule update --remote
+    - name: Check for changes
+      id: state
+      run: |
+        if ! git diff-index --quiet HEAD --; then
+          echo "Detected changes..."
+          echo "::set-output name=dirty::true"
+        fi
+    - name: Create PR
+      if: steps.state.outputs.dirty == 'true'
+      uses: peter-evans/create-pull-request@v3
+      with:
+        token: ${{ secrets.CREDENTIALS_GITHUB_PUSH_TOKEN }}
+        title: Update Envoy
+        commit-message: |
+            Update Envoy
+
+            Signed-off-by: GitHub Action <noreply@github.com>
+        committer: GitHub Action <noreply@github.com>
+        base: main
+        delete-branch: true
+        branch: update-envoy
+        branch-suffix: short-commit-hash