diff --git a/.github/workflows/submodule.yaml b/.github/workflows/submodule.yaml
index dba8d77b1..973d3cdea 100644
--- a/.github/workflows/submodule.yaml
+++ b/.github/workflows/submodule.yaml
@@ -46,3 +46,37 @@ jobs:
         git_hash="$(git rev-parse --short :web-client)"
         git commit -S -m "build(web-client): update submodule to $git_hash" || echo "No changes to commit"
         git push
+
+  update-cryostat3-submodule:
+    if: ${{ github.repository_owner == 'cryostatio' }}
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        repository: cryostatio/cryostat3
+        token: "${{ secrets.SUBMODULE_TOKEN }}"
+        ref: "${{ github.ref_name }}"
+    - name: Check remote cryostat3 submodule branch
+      run: |
+        remote_branch="$(git config --get -f .gitmodules submodule."src/main/webui".branch)"
+        if [[ "$remote_branch" != "${{ github.ref_name }}" ]]; then
+          printf "Expected remote branch %s, found branch %s\n" "${{ github.ref_name }}" "$remote_branch" >&2
+          exit 1
+        fi
+    - name: Import GPG key
+      uses: crazy-max/ghaction-import-gpg@v6
+      with:
+        gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+        passphrase: ${{ secrets.GPG_PASSPHRASE }}
+        git_user_signingkey: true
+        git_commit_gpgsign: true
+    - name: Update submodule to latest commit
+      run: |
+        git submodule update --init
+        git submodule update --remote
+    - name: Commit and push submodule
+      run: |
+        git add --all
+        git_hash="$(git rev-parse --short :src/main/webui)"
+        git commit -S -m "build(webui): update submodule to $git_hash" || echo "No changes to commit"
+        git push