diff --git a/.github/mergify.yml b/.github/mergify.yml
new file mode 100644
index 0000000..191717e
--- /dev/null
+++ b/.github/mergify.yml
@@ -0,0 +1,17 @@
+pull_request_rules:
+  - name: automatic merge on CI success
+    conditions:
+      - base=master
+      - check-success=ci/hercules/evaluation
+      - check-success=ci/hercules/onPush/default
+      - or:
+          - and:
+              - author=github-actions[bot]
+              - label=automerge
+          - and:
+              - author=hercules-ci[bot]
+    actions:
+      merge:
+        method: rebase
+        allow_merging_configuration_change: true
+      delete_head_branch: {}
diff --git a/.github/settings.yml b/.github/settings.yml
index 1093c0a..94e81cd 100644
--- a/.github/settings.yml
+++ b/.github/settings.yml
@@ -152,6 +152,6 @@ branches:
       required_linear_history: false
       # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
       restrictions:
-        apps: ["hercules-ci"]
-        users: ["nix-infra-bot"]
+        apps: ["mergify"]
+        users: []
         teams: []
diff --git a/.github/workflows/flake-updates-nixpkgs-update.yml b/.github/workflows/flake-updates-nixpkgs-update.yml
index 138c60b..6e3cb3f 100644
--- a/.github/workflows/flake-updates-nixpkgs-update.yml
+++ b/.github/workflows/flake-updates-nixpkgs-update.yml
@@ -13,12 +13,8 @@ jobs:
           extra_nix_config: |
             experimental-features = nix-command flakes
       - name: Update flake.lock
-        id: update
         uses: DeterminateSystems/update-flake-lock@v19
         with:
-          token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
           inputs: nixpkgs-update
-      - name: Enable Automerge
-        run: gh pr merge --rebase --auto "${{ steps.update.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
+          pr-labels: |
+            automerge
diff --git a/flake.nix b/flake.nix
index 05aeea6..6e3c689 100644
--- a/flake.nix
+++ b/flake.nix
@@ -61,7 +61,6 @@
         hercules-ci.flake-update = {
           enable = true;
           createPullRequest = true;
-          autoMergeMethod = "rebase";
           when = {
             hour = [ 2 ];
             dayOfWeek = [ "Mon" "Thu" ];