diff --git a/.github/workflows/sync-enterprise-submodule.yml b/.github/workflows/sync-enterprise-submodule.yml
new file mode 100644
index 0000000000..ea843c01a0
--- /dev/null
+++ b/.github/workflows/sync-enterprise-submodule.yml
@@ -0,0 +1,87 @@
+name: Sync Enterprise submodule
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ develop ]
+    paths: [ enterprise ]
+  schedule:
+    # At 06:00 UTC every day
+    - cron: '0 6 * * *'
+
+permissions: {}
+
+jobs:
+  sync-enterprise-submodule:
+    runs-on: ubuntu-latest
+    # Skip in forks
+    if: github.repository == 'element-hq/element-x-android'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Add SSH private keys for submodule repositories
+        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
+        with:
+          ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
+      - name: Check enterprise submodule reference
+        id: check
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          current=$(git ls-tree HEAD enterprise | awk '{print $3}')
+          # Do not init the submodule: the current commit may be on a deleted branch.
+          git init -q "$RUNNER_TEMP/enterprise"
+          git -C "$RUNNER_TEMP/enterprise" fetch -q git@github.com:element-hq/element-android-enterprise.git main
+          main=$(git -C "$RUNNER_TEMP/enterprise" rev-parse FETCH_HEAD)
+          if git -C "$RUNNER_TEMP/enterprise" merge-base --is-ancestor "$current" "$main" 2>/dev/null; then
+            on_main=true
+          else
+            on_main=false
+          fi
+          echo "Current: $current, main: $main, current is on main: $on_main"
+
+          if [ "$current" = "$main" ]; then
+            echo "Submodule is already up to date."
+            echo "update=false" >> "$GITHUB_OUTPUT"
+          elif [ "$EVENT_NAME" = "push" ] && [ "$on_main" = "true" ]; then
+            echo "Submodule targets a commit on main, nothing to do."
+            echo "update=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "update=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          {
+            echo "body<<EOF"
+            if [ "$on_main" = "true" ]; then
+              echo "Update the \`enterprise\` submodule from \`$current\` to the latest commit of \`main\` (\`$main\`)."
+              echo
+              echo "New commits:"
+              echo
+              git -C "$RUNNER_TEMP/enterprise" log --format='- %h %s' "$current..$main"
+            else
+              echo "The \`enterprise\` submodule targets \`$current\`, which is not on the \`main\` branch."
+              echo
+              echo "Update it to the latest commit of \`main\` (\`$main\`)."
+            fi
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+          if [ "$current" != "$main" ]; then
+            # Update the submodule reference without cloning it.
+            git update-index --cacheinfo "160000,$main,enterprise"
+            git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+              commit -q -m "Update enterprise submodule to latest main" -m "Update to $main"
+          fi
+      - name: Create Pull Request to update the enterprise submodule
+        # On schedule and manual runs, also run when there is nothing to update, so that a stale PR gets closed.
+        if: ${{ steps.check.outputs.update == 'true' || github.event_name != 'push' }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.DANGER_GITHUB_API_TOKEN }}
+          title: Update enterprise submodule to latest main
+          body: ${{ steps.check.outputs.body }}
+          branch: sync-enterprise-submodule
+          base: develop
+          delete-branch: true
+          labels: PR-Element-Pro