diff --git a/.github/workflows/update-branches.yml b/.github/workflows/update-branches.yml
new file mode 100644
index 0000000..96dcefd
--- /dev/null
+++ b/.github/workflows/update-branches.yml
@@ -0,0 +1,55 @@
+# Vendor as .github/workflows/update-branches.yml. Keeps open pull-request branches current with
+# the default branch; conflicts receive the `carry needed` label for a coordinator to resolve.
+name: update-branches
+
+on:
+  push:
+  workflow_call:
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  update:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update branches that are behind
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const baseCommit = context.sha;
+            const pulls = await github.paginate(github.rest.pulls.list, {
+              owner, repo, state: 'open', base: context.payload.repository.default_branch,
+            });
+            for (const pull of pulls) {
+              const comparison = await github.rest.repos.compareCommitsWithBasehead({
+                owner, repo, basehead: `${pull.head.sha}...${baseCommit}`,
+              });
+              if (comparison.data.status !== 'ahead' && comparison.data.status !== 'diverged') continue;
+              try {
+                await github.rest.pulls.updateBranch({
+                  owner, repo, pull_number: pull.number, expected_head_sha: pull.head.sha,
+                });
+                try {
+                  await github.rest.issues.removeLabel({
+                    owner, repo, issue_number: pull.number, name: 'carry needed',
+                  });
+                } catch (error) {
+                  if (error.status !== 404) throw error;
+                }
+              } catch (error) {
+                if (error.status !== 409 && error.status !== 422) throw error;
+                await github.rest.issues.addLabels({
+                  owner, repo, issue_number: pull.number, labels: ['carry needed'],
+                });
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number: pull.number,
+                  body: `Carry needed from base commit ${baseCommit}.`,
+                });
+              }
+            }
diff --git a/scripts/dev/check.sh b/scripts/dev/check.sh
index 1c8e375..f0fe3f5 100755
--- a/scripts/dev/check.sh
+++ b/scripts/dev/check.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# from judgment-pack-devkit v0.4.0 (templates/check.sh)
+# from judgment-pack-devkit v0.5.0 (templates/check.sh)
 # scripts/dev/check.sh [--setup] [--only a,b] [--skip a,b] [--all] [--manifest FILE]
 # Runs the checks of dev.json in order and prints one summary block; exit status = failures.
 # Stops at the first failure unless --all. --setup runs the manifest's setup steps instead.