diff --git a/.github/actions/pulumitools/action.yaml b/.github/actions/pulumitools/action.yaml
new file mode 100644
index 0000000..f4f675d
--- /dev/null
+++ b/.github/actions/pulumitools/action.yaml
@@ -0,0 +1,36 @@
+name: Install Pulumi Tools
+description: "Install Pulumi Tools for pipeline"
+inputs:
+  dotnet-version:
+    description: "Dotnet version to install"
+    required: false
+    default: 9.0.x
+  node-version:
+    description: "node version to install"
+    required: false
+    default: 20.x
+  python-version:
+    description: "python version to install"
+    required: false
+    default: "3.9"
+runs:
+  using: "composite"
+  steps:
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # tag=v2.1.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install pulumi
+      uses: pulumi/actions@v6
+    - name: Setup Node
+      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # tag=v6.0.0
+      with:
+        node-version: ${{ inputs.node-version }}
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # tag=v5.0.0
+      with:
+        dotnet-version: ${{ inputs.dotnet-version }}
+    - name: Setup Python
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # tag=v6.0.0
+      with:
+        python-version: ${{ inputs.python-version }}
\ No newline at end of file
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 30b754b..7329286 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -32,28 +32,12 @@ jobs:
       # TODO: remove end
       - name: Unshallow clone for tags
         run: git fetch --prune --unshallow --tags
-      - name: Install pulumictl
-        uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # tag=v2.1.0
-        with:
-          repo: pulumi/pulumictl
-      - name: Install pulumi
-        uses: pulumi/actions@v6
       - name: Install Go Tools
         uses: ./.github/actions/gotools
         with:
           go-version: ${{ env.GO_VERSION }}
-      - name: Setup Node
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # tag=v6.0.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-      - name: Setup DotNet
-        uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # tag=v5.0.0
-        with:
-          dotnet-version: ${{ env.DOTNET_VERSION }}
-      - name: Setup Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # tag=v6.0.0
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install Pulumi Tools
+        uses: ./.github/actions/pulumitools
       - name: Build sdks
         run: make generate_sdks
       - name: Lint
diff --git a/.github/workflows/upgrade-provider.yaml b/.github/workflows/upgrade-provider.yaml
index 4456f41..4ca713e 100644
--- a/.github/workflows/upgrade-provider.yaml
+++ b/.github/workflows/upgrade-provider.yaml
@@ -1,15 +1,3 @@
-env:
-  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-jobs:
-  upgrade_provider:
-    if: ${{ (contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
-    name: upgrade-provider
-    runs-on: ubuntu-latest
-    steps:
-    - name: Call upgrade provider action
-      uses: pulumi/pulumi-upgrade-provider-action@e247104aede3eb4641f48c8ad0ea9de9346f2457 # v0.0.18
-      with:
-        kind: all
 name: Upgrade provider
 
 permissions:
@@ -21,3 +9,50 @@ on:
     types:
     - opened
   workflow_dispatch: {}
+
+env:
+  GH_TOKEN: ${{ secrets.PR_TOKEN }}
+  GO_VERSION: "1.24"
+
+jobs:
+  upgrade_provider:
+    if: ${{ (contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
+    name: upgrade-provider
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+    # TODO: remove when this repo is made public
+    - name: Configure Git for Private Modules
+      run: |
+        git config --global url."https://oauth2:${{ secrets.PR_TOKEN }}@github.com".insteadOf "https://github.com"
+        # Sets GOPRIVATE and GONOSUMDB in order to use the git authetnication for go mod.
+        echo "GOPRIVATE=github.com/${{ github.repository }}/*,github.com/stackitcloud/*" >> $GITHUB_ENV
+        echo "GONOSUMDB=github.com/${{ github.repository }}/*,github.com/stackitcloud/*" >> $GITHUB_ENV
+    # TODO: remove end
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
+    - name: Install Go Tools
+      uses: ./.github/actions/gotools
+      with:
+        go-version: ${{ env.GO_VERSION }}
+    - name: Install Pulumi Tools
+      uses: ./.github/actions/pulumitools
+    - name: Get latest tag from terraform-provider-stackit and update the pulumi provider and bridge
+      run: |
+        git config user.name "Pulumi Generator Bot"
+        git config user.email "noreply@stackit.de"
+        LATEST_TAG=$(git ls-remote --tags https://github.com/stackitcloud/terraform-provider-stackit | grep -oP 'refs/tags/v\d+\.\d+\.\d+$' |sed 's/refs\/tags\///' | sort -V | tail -n 1)
+        BRANCH_NAME="upgrade-terraform-provider-stackit-to-$LATEST_TAG"
+        git checkout -b "$BRANCH_NAME"
+        (cd provider && go get github.com/stackitcloud/terraform-provider-stackit@"$LATEST_TAG")
+        (cd provider/shim && go get github.com/stackitcloud/terraform-provider-stackit@"$LATEST_TAG")
+        make ensure
+        make tfgen
+        git add --all
+        git commit -m "make tfgen"
+        make generate_sdks
+        git add --all
+        git commit -m "make generate_sdks"
+        git push --set-upstream origin "$BRANCH_NAME"
+        gh pr create --title "Upgrade terraform-provider-stackit to $LATEST_TAG" --body "This PR was generated by the Pulumi upgrade CI pipeline" --base main --head "$BRANCH_NAME"