diff --git a/.gitattributes b/.gitattributes
index 84de6bcd..ba3fc738 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,6 +4,7 @@
 /.eslintrc.json                            	linguist-generated
 /.gitattributes                            	linguist-generated
 /.github/pull_request_template.md          	linguist-generated
+/.github/workflows/auto-approve.yml        	linguist-generated
 /.github/workflows/build.yml               	linguist-generated
 /.github/workflows/release.yml             	linguist-generated
 /.github/workflows/upgrade-dependencies.yml	linguist-generated
diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
new file mode 100644
index 00000000..d68c8140
--- /dev/null
+++ b/.github/workflows/auto-approve.yml
@@ -0,0 +1,22 @@
+# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+
+name: auto-approve
+on:
+  pull_request_target:
+    types:
+      - labeled
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+jobs:
+  approve:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    if: contains(github.event.pull_request.labels.*.name, 'auto-approve') &&
+      (github.event.pull_request.user.login == 'cdklabs-automation')
+    steps:
+      - uses: hmarr/auto-approve-action@v2.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/upgrade-dependencies.yml b/.github/workflows/upgrade-dependencies.yml
index 81a03335..6f329ed5 100644
--- a/.github/workflows/upgrade-dependencies.yml
+++ b/.github/workflows/upgrade-dependencies.yml
@@ -58,7 +58,7 @@ jobs:
         id: create-pr
         uses: peter-evans/create-pull-request@v3
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
           commit-message: >-
             chore(deps): upgrade dependencies
 
@@ -75,6 +75,7 @@ jobs:
             *Automatically created by projen via the "upgrade-dependencies" workflow*
           branch: github-actions/upgrade-dependencies
           title: "chore(deps): upgrade dependencies"
+          labels: auto-approve
           body: >-
             Upgrades project dependencies. See details in [workflow run].
 
diff --git a/.gitignore b/.gitignore
index 4d0ac75c..4707dcf9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,6 +33,7 @@ yarn-error.log*
 !/.eslintrc.json
 !/.gitattributes
 !/.github/pull_request_template.md
+!/.github/workflows/auto-approve.yml
 !/.github/workflows/build.yml
 !/.github/workflows/release.yml
 !/.github/workflows/upgrade-dependencies.yml
diff --git a/.projen/tasks.json b/.projen/tasks.json
index b89fa255..e0ec94f9 100644
--- a/.projen/tasks.json
+++ b/.projen/tasks.json
@@ -151,34 +151,13 @@
       },
       "steps": [
         {
-          "exec": "npm-check-updates --upgrade --target=minor --reject='projen'"
+          "exec": "npm-check-updates --upgrade --target=minor"
         },
         {
           "exec": "yarn install --check-files"
         },
         {
-          "exec": "yarn upgrade @aws-cdk/assert @aws-cdk/aws-lambda @aws-cdk/aws-s3 @aws-cdk/core @aws-cdk/cx-api @aws-cdk/pipelines @types/jest @types/node @typescript-eslint/eslint-plugin @typescript-eslint/parser eslint eslint-import-resolver-node eslint-import-resolver-typescript eslint-plugin-import jest jest-junit jsii jsii-diff jsii-docgen jsii-pacmak json-schema npm-check-updates standard-version ts-jest typescript decamelize yaml @aws-cdk/core @aws-cdk/cx-api @aws-cdk/pipelines constructs"
-        },
-        {
-          "exec": "npx projen"
-        }
-      ]
-    },
-    "upgrade-projen": {
-      "name": "upgrade-projen",
-      "description": "upgrade projen",
-      "env": {
-        "CI": "0"
-      },
-      "steps": [
-        {
-          "exec": "npm-check-updates --upgrade --target=minor --filter='projen'"
-        },
-        {
-          "exec": "yarn install --check-files"
-        },
-        {
-          "exec": "yarn upgrade projen"
+          "exec": "yarn upgrade"
         },
         {
           "exec": "npx projen"
diff --git a/.projenrc.js b/.projenrc.js
index 683153d1..b0df588b 100644
--- a/.projenrc.js
+++ b/.projenrc.js
@@ -26,6 +26,10 @@ const project = new AwsCdkConstructLibrary({
     dotNetNamespace: 'Cdklabs.CdkPipelinesGitHub',
     packageId: 'Cdklabs.CdkPipelinesGitHub',
   },
+
+  projenUpgradeSecret: 'PROJEN_GITHUB_TOKEN',
+  autoApproveUpgrades: true,
+  autoApproveOptions: { allowedUsernames: ['cdklabs-automation'], secret: 'GITHUB_TOKEN' },
 });
 
 project.addPeerDeps('@aws-cdk/core');
@@ -39,4 +43,4 @@ project.addDevDeps('@aws-cdk/pipelines');
 project.addDevDeps('@aws-cdk/aws-lambda');
 project.addDevDeps('@aws-cdk/aws-s3');
 
-project.synth();
\ No newline at end of file
+project.synth();
diff --git a/package.json b/package.json
index d3ecaab4..58dd9766 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,6 @@
     "bump": "npx projen bump",
     "unbump": "npx projen unbump",
     "upgrade-dependencies": "npx projen upgrade-dependencies",
-    "upgrade-projen": "npx projen upgrade-projen",
     "default": "npx projen default",
     "watch": "npx projen watch",
     "package": "npx projen package",