diff --git a/.github/workflows/go-fix.yml b/.github/workflows/go-fix.yml
new file mode 100644
index 00000000000..c6103cf9e57
--- /dev/null
+++ b/.github/workflows/go-fix.yml
@@ -0,0 +1,95 @@
+name: go-fix
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'go.mod'
+      - 'pkg/api/go.mod'
+  workflow_dispatch:
+
+concurrency:
+  group: go-fix
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  go-fix:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 2
+
+      - name: Check if Go version changed
+        id: go-version
+        run: |
+          ROOT_CURRENT=$(grep '^go ' go.mod | awk '{print $2}')
+          API_CURRENT=$(grep '^go ' pkg/api/go.mod | awk '{print $2}')
+          GO_VERSION=$(printf '%s\n' "$ROOT_CURRENT" "$API_CURRENT" | sort -V | tail -1)
+          echo "current=$GO_VERSION" >> "$GITHUB_OUTPUT"
+          echo "root=$ROOT_CURRENT" >> "$GITHUB_OUTPUT"
+          echo "api=$API_CURRENT" >> "$GITHUB_OUTPUT"
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            ROOT_PREVIOUS=$(git show HEAD~1:go.mod | grep '^go ' | awk '{print $2}')
+            API_PREVIOUS=$(git show HEAD~1:pkg/api/go.mod | grep '^go ' | awk '{print $2}')
+            if [[ "$ROOT_CURRENT" != "$ROOT_PREVIOUS" ]] || [[ "$API_CURRENT" != "$API_PREVIOUS" ]]; then
+              echo "run=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "run=false" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+      - name: Set up Golang
+        if: steps.go-version.outputs.run == 'true'
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: ${{ steps.go-version.outputs.current }}
+
+      - name: Run go fix
+        if: steps.go-version.outputs.run == 'true'
+        run: make go-fix
+
+      - name: Create Pull Request
+        if: steps.go-version.outputs.run == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="automated/go-fix-root-${{ steps.go-version.outputs.root }}-api-${{ steps.go-version.outputs.api }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No changes from go fix, skipping PR creation."
+            exit 0
+          fi
+          git commit -m "run go fix for Go ${{ steps.go-version.outputs.current }}"
+          git push --force origin "$BRANCH"
+          EXISTING_PR=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number')
+          if [[ -n "$EXISTING_PR" ]]; then
+            echo "PR #$EXISTING_PR already exists for branch $BRANCH, skipping creation."
+          else
+            gh pr create \
+              --title "go fix: apply Go ${{ steps.go-version.outputs.current }} fixes" \
+              --body "This PR was automatically created to apply \`go fix\` changes after bumping Go.
+
+          - Root module: \`${{ steps.go-version.outputs.root }}\`
+          - API module: \`${{ steps.go-version.outputs.api }}\`
+
+          \`go fix\` rewrites source code to use newer Go APIs and idioms." \
+              --base "${{ github.event.repository.default_branch }}" \
+              --head "$BRANCH"
+          fi
diff --git a/Makefile b/Makefile
index 4918d012304..e75c4993911 100644
--- a/Makefile
+++ b/Makefile
@@ -345,6 +345,11 @@ fmt: $(GOLANGCI_LINT) ## Format Go source files using golangci-lint formatters (
 	$(GOLANGCI_LINT) fmt
 	cd pkg/api/ && $(GOLANGCI_LINT) fmt
 
+.PHONY: go-fix
+go-fix: ## Run go fix on both Go modules
+	go fix ./...
+	cd pkg/api/ && go fix ./...
+
 .PHONY: lint-go
 lint-go: $(GOLANGCI_LINT)
 	$(GOLANGCI_LINT) run --verbose
diff --git a/go.mod b/go.mod
index 56932fd5af4..322d21228df 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,6 @@
 module github.com/Azure/ARO-RP
 
 go 1.25.3
-
 require (
 	github.com/Azure/ARO-RP/pkg/api v0.0.0-00010101000000-000000000000
 	github.com/Azure/azure-sdk-for-go v63.1.0+incompatible
diff --git a/pkg/api/go.mod b/pkg/api/go.mod
index 173311915ba..2611d99b8c0 100644
--- a/pkg/api/go.mod
+++ b/pkg/api/go.mod
@@ -1,7 +1,6 @@
 module github.com/Azure/ARO-RP/pkg/api
 
 go 1.24.0
-
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0
 	github.com/Azure/go-autorest/autorest v0.11.29
diff --git a/test/e2e/aks.go b/test/e2e/aks.go
index f0ce65693f6..2e7ec12af02 100644
--- a/test/e2e/aks.go
+++ b/test/e2e/aks.go
@@ -1,5 +1,4 @@
 //go:build e2e
-// +build e2e
 
 package e2e
 
diff --git a/test/e2e/aro.go b/test/e2e/aro.go
index c2f56b593fd..f7fb8a6683a 100644
--- a/test/e2e/aro.go
+++ b/test/e2e/aro.go
@@ -1,5 +1,4 @@
 //go:build e2e
-// +build e2e
 
 package e2e
 
diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go
index 1798fa2175b..e6b3426111e 100644
--- a/test/e2e/e2e_test.go
+++ b/test/e2e/e2e_test.go
@@ -1,5 +1,4 @@
 //go:build e2e
-// +build e2e
 
 package e2e