diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
new file mode 100644
index 000000000..97eed0a3f
--- /dev/null
+++ b/.github/workflows/autofix.yml
@@ -0,0 +1,34 @@
+name: autofix.ci # needed to securely identify the workflow
+
+on:
+  pull_request:
+  push:
+    branches: ["master"]
+permissions:
+  contents: read
+
+jobs:
+  autofix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Install Nix and set up Cachix
+      - uses: cachix/install-nix-action@V27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          extraPullNames: devenv
+          name: copier
+          pushFilter: (-source$|nixpkgs\.tar\.gz$)
+
+      # Autoformat and try to push back changes
+      - run: nix develop --impure -c pre-commit run -a --show-diff-on-failure
+        continue-on-error: true
+      # HACK https://github.com/autofix-ci/action/pull/15
+      - run: nix develop --impure -c pre-commit uninstall -t pre-commit -t commit-msg
+      - uses: autofix-ci/action@v1.3
+        with:
+          commit-message: "style: autoformat with pre-commit"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0eba66bc..82107abc1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,15 +134,6 @@ jobs:
           cache-store: "false"
       - run: copier --version
 
-      # Autoformat and try to push back changes
-      - run: pre-commit run -a
-        continue-on-error: true
-      - uses: stefanzweifel/git-auto-commit-action@v5
-        continue-on-error: true
-        with:
-          commit_message: "style: autoformat with pre-commit"
-          commit_options: --no-verify
-
       # Run nix checks
       - run: nix flake check -L --accept-flake-config --impure