diff --git a/.github/workflows/update-protobuf.yml b/.github/workflows/update-protobuf.yml
new file mode 100644
index 000000000..78c38c42e
--- /dev/null
+++ b/.github/workflows/update-protobuf.yml
@@ -0,0 +1,27 @@
+name: update-protobuf
+on:
+  workflow_dispatch:
+    inputs:
+      envoy_version:
+        description: 'Envoy version to update to'
+        required: true
+
+jobs:
+  update-protobuf:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run scripts
+        working-directory: ./tools/
+        run: |
+          ./update-sha.sh ${{ github.event.inputs.envoy_version }} | tee /dev/tty > API_SHAS
+          ./update-api.sh
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v3
+        with:
+          branch: update-protobuf-to-${{ github.event.inputs.envoy_version }}
+          signoff: true
+          title: '[protobuf] Update protobuf definitions to ${{ github.event.inputs.envoy_version }}'
+          body: |
+            This is an automatic PR created by github action workflow:
+            - Updated protobuf files
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java b/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java
index 9ef0d8d74..6bc8ac8ed 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java
@@ -30,8 +30,9 @@ class EnvoyContainer extends GenericContainer<EnvoyContainer> {
   }
 
   EnvoyContainer(String config, Supplier<Integer> controlPlanePortSupplier, int apiVersion) {
+    // this version is changed automatically by /tools/update-sha.sh:57
+    // if you change it make sure to reflect changes there
     super("envoyproxy/envoy-alpine-dev:bef18019d8fc33a4ed6aca3679aff2100241ac5e");
-
     this.config = config;
     this.controlPlanePortSupplier = controlPlanePortSupplier;
     this.apiVersion = apiVersion;
diff --git a/tools/update-api.sh b/tools/update-api.sh
index d33e61637..46a5faf79 100755
--- a/tools/update-api.sh
+++ b/tools/update-api.sh
@@ -43,7 +43,7 @@ cp googleapis-*/google/api/expr/v1alpha1/syntax.proto "${protodir}/google/api/ex
 cp googleapis-*/google/api/expr/v1alpha1/checked.proto "${protodir}/google/api/expr/v1alpha1"
 cp googleapis-*/google/rpc/status.proto "${protodir}/google/rpc"
 
-curl -sL https://github.com/envoyproxy/protoc-gen-validate/archive/${PGV_GIT_SHA}.tar.gz | tar xz --include="*.proto"
+curl -sL https://github.com/envoyproxy/protoc-gen-validate/archive/v${PGV_VERSION}.tar.gz | tar xz --include="*.proto"
 mkdir -p "${protodir}/validate"
 cp -r protoc-gen-validate-*/validate/* "${protodir}/validate"
 
@@ -52,7 +52,8 @@ mkdir -p "${protodir}/opencensus/proto"
 cp -r opencensus-proto-*/src/opencensus/proto/* "${protodir}/opencensus/proto"
 
 curl -sL https://github.com/prometheus/client_model/archive/${PROMETHEUS_SHA}.tar.gz | tar xz --include="*.proto"
-cp client_model-*/metrics.proto "${protodir}"
+mkdir -p "${protodir}/io/prometheus/client/"
+cp client_model-*/io/prometheus/client/metrics.proto "${protodir}/io/prometheus/client/"
 
 curl -sL https://github.com/cncf/xds/archive/${UDPA_SHA}.tar.gz | tar xz --include="*.proto"
 mkdir -p "${protodir}/udpa"
diff --git a/tools/update-sha.sh b/tools/update-sha.sh
new file mode 100755
index 000000000..d46049142
--- /dev/null
+++ b/tools/update-sha.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+function find_sha() {
+  local CONTENT=$1
+  local DEPENDENCY=$2
+  echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 version | awk '{ print $3 }' | tr -d '"' | tr -d ","
+}
+
+function find_date() {
+  local CONTENT=$1
+  local DEPENDENCY=$2
+  echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 release_date | awk '{ print $3 }' | tr -d '"' | tr -d ","
+}
+
+function find_envoy_sha_from_tag() {
+  local TAG=$1
+  curl -s https://api.github.com/repos/envoyproxy/envoy/tags | grep "$TAG" -A 4 | grep sha | awk '{print $2}' | tr -d '"' | tr -d ","
+}
+
+ENVOY_VERSION=$(find_envoy_sha_from_tag "$1")
+
+CURL_OUTPUT=$(curl -s "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/bazel/repository_locations.bzl")
+
+GOOGLEAPIS_SHA=$(find_sha "$CURL_OUTPUT" com_google_googleapis)
+GOOGLEAPIS_DATE=$(find_date "$CURL_OUTPUT" com_google_googleapis)
+
+PGV_GIT_SHA=$(find_sha "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate)
+PGV_GIT_DATE=$(find_date "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate)
+
+PROMETHEUS_SHA=$(find_sha "$CURL_OUTPUT" prometheus_metrics_model)
+PROMETHEUS_DATE=$(find_date "$CURL_OUTPUT" prometheus_metrics_model)
+
+OPENCENSUS_SHA=$(find_sha "$CURL_OUTPUT" opencensus_proto)
+OPENCENSUS_DATE=$(find_date "$CURL_OUTPUT" opencensus_proto)
+
+UDPA_SHA=$(find_sha "$CURL_OUTPUT" com_github_cncf_udpa)
+UDPA_DATE=$(find_date "$CURL_OUTPUT" com_github_cncf_udpa)
+
+OPENTELEMETRY_SHA=$(find_sha "$CURL_OUTPUT" opentelemetry_proto)
+OPENTELEMETRY_DATE=$(find_date "$CURL_OUTPUT" opentelemetry_proto)
+
+echo -n "# Update the versions here and run update-api.sh
+
+# envoy (source: SHA from https://github.com/envoyproxy/envoy)
+ENVOY_SHA=\"$ENVOY_VERSION\"
+
+# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/bazel/repository_locations.bzl)
+GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\"  # $GOOGLEAPIS_DATE
+PGV_VERSION=\"$PGV_GIT_SHA\"  # $PGV_GIT_DATE
+PROMETHEUS_SHA=\"$PROMETHEUS_SHA\"  # $PROMETHEUS_DATE
+OPENCENSUS_VERSION=\"$OPENCENSUS_SHA\"  # $OPENCENSUS_DATE
+OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\"  # $OPENTELEMETRY_DATE
+UDPA_SHA=\"$UDPA_SHA\"  # $UDPA_DATE
+"
+
+# replace version in EnvoyContainer.java
+sed -i 's/\(envoy-alpine-dev:\).*\(\");\)/\1'"$ENVOY_VERSION"'\2/g'  ../server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java