diff --git a/.ci/ci.yml.tmpl b/.ci/ci.yml.tmpl
index 6472fab77be8..2f61166c19df 100644
--- a/.ci/ci.yml.tmpl
+++ b/.ci/ci.yml.tmpl
@@ -411,6 +411,10 @@ jobs:
       plan:
           - get: mm-approved-prs
             attempts: 2
+          - task: ensure-downstreams-merged
+            file: mm-approved-prs/.ci/magic-modules/ensure-downstreams-merged.yml
+            params:
+                GH_TOKEN: ((github-account.password))
           - put: mark-automerged
             resource: mm-approved-prs
             params:
diff --git a/.ci/magic-modules/ensure-downstreams-merged.yml b/.ci/magic-modules/ensure-downstreams-merged.yml
new file mode 100644
index 000000000000..389d122e2bc6
--- /dev/null
+++ b/.ci/magic-modules/ensure-downstreams-merged.yml
@@ -0,0 +1,24 @@
+---
+# This file takes in only magic-modules, to get the code that
+# it runs.  It does need the github API token.
+# It produces no output.
+platform: linux
+
+image_resource:
+    type: docker-image
+    source:
+        # This task requires a container with python and the pip
+        # package 'pygithub'.
+        repository: gcr.io/magic-modules/python
+        tag: '1.0'
+
+inputs:
+    - name: mm-approved-prs
+
+params:
+    GH_TOKEN: ""
+
+run:
+    path: mm-approved-prs/.ci/magic-modules/ensure_downstreams_merged.py
+    args:
+        - mm-approved-prs/.git/id
diff --git a/.ci/magic-modules/ensure_downstreams_merged.py b/.ci/magic-modules/ensure_downstreams_merged.py
new file mode 100755
index 000000000000..57844ab7a5ef
--- /dev/null
+++ b/.ci/magic-modules/ensure_downstreams_merged.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python
+
+import get_downstream_prs
+from github import Github
+import os
+import re
+import operator
+import itertools
+import sys
+
+
+def get_unmerged_prs(g, dependencies):
+  parsed_dependencies = [re.match(r'https://github.com/([\w-]+/[\w-]+)/pull/(\d+)', d).groups()
+          for d in dependencies]
+  parsed_dependencies.sort(key=operator.itemgetter(0))
+  unmerged_dependencies = []
+  # group those dependencies by repo - e.g. [("terraform-provider-google", ["123", "456"]), ...]
+  for r, pulls in itertools.groupby(parsed_dependencies, key=operator.itemgetter(0)):
+    repo = g.get_repo(r)
+    for pull in pulls:
+      # check whether the PR is merged - if it is, add it to the list.
+      pr = repo.get_pull(int(pull[1]))
+      if not pr.is_merged():
+        unmerged_dependencies.append(pull)
+  return unmerged_dependencies
+
+
+if __name__ == '__main__':
+  g = Github(os.environ.get('GH_TOKEN'))
+  assert len(sys.argv) == 2
+  id_filename = sys.argv[1]
+  unmerged = get_unmerged_prs(
+          g, get_downstream_prs.get_github_dependencies(
+              g, int(open(id_filename).read())))
+  if unmerged:
+    raise ValueError("some PRs are unmerged", unmerged)
diff --git a/.ci/magic-modules/welcome-contributor.sh b/.ci/magic-modules/welcome-contributor.sh
old mode 100644
new mode 100755