diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000000..ae12faa9d7
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+.github/workflows/enforce-stg-source.yml @feuerswut
+.github/workflows/sync-stg-with-main.yml @feuerswut
diff --git a/.github/workflows/enforce-stg-source.yml b/.github/workflows/enforce-stg-source.yml
new file mode 100644
index 0000000000..117b4942f3
--- /dev/null
+++ b/.github/workflows/enforce-stg-source.yml
@@ -0,0 +1,22 @@
+name: Enforce stg source
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited, ready_for_review]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check-source:
+    name: enforce-stg-source
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify PR originates from stg
+        run: |
+          if [ "${{ github.event.pull_request.head.ref }}" != "stg" ]; then
+            echo "Only the 'stg' branch may open pull requests into 'main'. Got head ref: ${{ github.event.pull_request.head.ref }}"
+            exit 1
+          fi
+          echo "OK: PR originates from stg"
diff --git a/.github/workflows/sync-stg-with-main.yml b/.github/workflows/sync-stg-with-main.yml
new file mode 100644
index 0000000000..924ac1e214
--- /dev/null
+++ b/.github/workflows/sync-stg-with-main.yml
@@ -0,0 +1,25 @@
+name: Sync stg with main
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: stg
+          fetch-depth: 0
+      - name: Fast-forward or merge main into stg
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git fetch origin main
+          git merge origin/main --no-edit
+          git push origin HEAD:stg