diff --git a/.github/workflows/black-format.yml b/.github/workflows/black-format.yml
new file mode 100644
index 000000000..dca1df175
--- /dev/null
+++ b/.github/workflows/black-format.yml
@@ -0,0 +1,68 @@
+name: black auto-format
+
+on:
+  pull_request:
+    branches: [ master ]
+    paths-ignore:
+      - 'web/**'
+      - 'doc/**'
+      - '**.md'
+  workflow_dispatch: # allow manual trigger
+
+permissions:
+  contents: write
+
+jobs:
+  black-format:
+    # only run on dependabot PRs or manual trigger
+    if: github.actor == 'dependabot[bot]' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ github.head_ref }}
+          # need a token with write access to push the commit
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        with:
+          python-version: "3.13"
+
+      - name: Install black and isort
+        run: pip install black isort
+
+      - name: Run isort
+        run: |
+          isort \
+            --length-sort \
+            --profile black \
+            --line-length 120 \
+            --skip-glob "*_pb2.py" \
+            capa/ scripts/ tests/ web/rules/scripts/
+
+      - name: Run black
+        run: |
+          black \
+            --line-length 120 \
+            --extend-exclude ".*_pb2.py" \
+            capa/ scripts/ tests/ web/rules/scripts/
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit and push formatting changes
+        if: steps.changes.outputs.has_changes == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "style: auto-format with black and isort"
+          git push