diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 46bb332..59cb01f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,8 +16,8 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: bun install
       - name: Check lockstep package versions
         run: |
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
new file mode 100644
index 0000000..51296c7
--- /dev/null
+++ b/.github/workflows/generate.yml
@@ -0,0 +1,87 @@
+name: Generate SDK
+
+on:
+  schedule:
+    # Run daily at 2 AM UTC to check for OpenAPI spec updates
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+    # Allow manual triggering
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  generate:
+    name: Generate SDK from production OpenAPI
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      SDK_BASE_BRANCH: ${{ github.ref_name }}
+      SDK_UPDATE_BRANCH: update-sdk-from-openapi
+
+    steps:
+      - name: Checkout SDK base branch
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          ref: ${{ env.SDK_BASE_BRANCH }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Fetch production OpenAPI spec
+        run: |
+          curl \
+            --fail \
+            --location \
+            --retry 3 \
+            --retry-all-errors \
+            --show-error \
+            --silent \
+            https://v0.app/api/v2/openapi/json \
+            | jq --indent 2 . > packages/v0-sdk/openapi.json
+
+      - name: Validate production OpenAPI spec
+        uses: oasdiff/oasdiff-action/validate@35b32248b144707e94e72a8d0a1456da9d6618c2 # v0.1.7
+        with:
+          spec: packages/v0-sdk/openapi.json
+
+      - name: Generate SDK
+        run: bun run generate
+
+      - name: Format generated code
+        run: bun run fmt
+
+      - name: Create or update SDK pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          sign-commits: true
+          base: ${{ env.SDK_BASE_BRANCH }}
+          branch: ${{ env.SDK_UPDATE_BRANCH }}
+          delete-branch: true
+          commit-message: 'chore: update SDK from production OpenAPI'
+          title: 'chore: update SDK from production OpenAPI'
+          reviewers: |
+            alex-grover
+            rickeyswuave
+          body: |
+            Fetches the latest OpenAPI document from the production API and regenerates the TypeScript SDK and AI tools.
+
+            Source: https://v0.app/api/v2/openapi/json
+
+            This PR is updated in place by the daily Generate SDK workflow. The repository automatically deletes its update branch after merge.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 129731c..37b1752 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,15 +20,15 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.sha }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
           package-manager-cache: false
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: bun install --frozen-lockfile
       - name: Build SDK
         run: |
@@ -110,7 +110,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: main
           fetch-depth: 0
@@ -136,12 +136,12 @@ jobs:
             echo "${COMMITS} commits since ${LAST_VERSION}; continuing with release PR."
             echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         if: steps.changes.outputs.skip != 'true'
         with:
           node-version: '24'
           package-manager-cache: false
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: steps.changes.outputs.skip != 'true'
       - if: steps.changes.outputs.skip != 'true'
         run: bun install --frozen-lockfile
@@ -240,15 +240,15 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.sha }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
           package-manager-cache: false
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: bun install --frozen-lockfile
       - name: Resolve shared latest version
         id: version