diff --git a/.factory-workflows/dependency-update.yaml b/.factory-workflows/dependency-update.yaml
new file mode 100644
index 00000000..af04d914
--- /dev/null
+++ b/.factory-workflows/dependency-update.yaml
@@ -0,0 +1,180 @@
+schema_version: v1
+name: dependency-update-troubleshoot
+enabled: true
+
+trigger:
+  cron:
+    schedule: "0 21 * * *"
+    timezone: "America/Chicago"
+    overlap_policy: skip
+    timeout: 2h
+
+enable_manual_trigger: true
+
+tags: ["cron", "dependencies"]
+color: cyan
+
+stages:
+  - id: start
+    label: Start
+    entry: true
+    on_enter:
+      inject: |
+        Workflow task: run the Go dependency update maintenance workflow for Troubleshoot.
+
+        This is an unattended dependency maintenance workflow. Scope: Go
+        dependency updates for the top-level go.mod/go.sum only. After updates
+        are applied, you will review the changes, fix any compatibility issues,
+        validate with make build and make test, and open one grouped PR.
+
+        Do not ask for permission to start. Immediately say exactly [PROCEED]
+        to run the dependency updater. Detailed post-update instructions will
+        follow.
+
+  - id: working
+    label: Working
+    triggers:
+      - message_contains: "[PROCEED]"
+    on_enter:
+      run:
+        command: |
+          bash -lc '
+            set -euo pipefail
+
+            if ! command -v go >/dev/null 2>&1; then
+              nix profile install nixpkgs#go_1_26 || nix-env -iA nixpkgs.go_1_26
+            fi
+
+            go_path="$(command -v go)"
+            go_version="$(go version)"
+            printf "{\"status\":\"ready\",\"go_path\":\"%s\",\"go_version\":\"%s\"}\n" "$go_path" "$go_version"
+          '
+        output: go_toolchain
+        timeout: 10m
+      dependency_updates:
+        ecosystems: [go]
+        paths: ["."]
+        output: dependency_updates
+        timeout: 30m
+      inject: |
+        Dependency updates were applied for the root Go module.
+
+        Scope this workflow to Go dependency updates only. Focus on the
+        top-level go.mod/go.sum. Exclude Node dependencies and any non-Go
+        modules.
+
+        Treat compatibility fixes as part of this workflow. If an updated
+        dependency causes build, lint, type, or test failures, first attempt
+        reasonable scoped code changes within the affected Go module to support
+        the new version. Do not downgrade, pin, or skip an update just because
+        it has breaking API changes unless the required changes are broad,
+        risky, unrelated to this workflow's scope, or cannot be completed within
+        reasonable effort. If you defer an update, explain exactly why.
+
+        Review {{ .Outputs.dependency_updates.files_changed }}.
+        Before opening a PR, validate using the repo make targets in the Nix
+        development environment (nix develop -c). Do not run ad-hoc go
+        commands; use exactly these targets:
+
+        - make build
+        - make test
+
+        Note: make test-integration requires a Kubernetes cluster. Only add it
+        to the validation if the workflow environment provides one.
+
+        Fix any failures and open one grouped PR.
+        Say [DONE] with the PR URL only when the PR is open.
+        If {{ .Outputs.dependency_updates.files_changed }} is empty and no PR is
+        needed, say [NO_CHANGES] instead of [DONE].
+
+  - id: no-changes
+    label: No Changes
+    triggers:
+      - message_contains: "[NO_CHANGES]"
+      - message_contains: "[DONE] No changes"
+    terminal: true
+
+  - id: validate
+    label: Validate
+    triggers:
+      - message_contains: "[DONE]"
+    on_enter:
+      run:
+        command: |
+          nix develop -c bash -lc '
+            set +e
+            tmpdir="$(mktemp -d)"
+
+            make build >"$tmpdir/build.log" 2>&1
+            build_status=$?
+
+            make test >"$tmpdir/test.log" 2>&1
+            test_status=$?
+
+            python3 - "$tmpdir" "$build_status" "$test_status" <<PY
+          import json
+          import pathlib
+          import sys
+
+          tmpdir = pathlib.Path(sys.argv[1])
+          statuses = {
+              "build": int(sys.argv[2]),
+              "test": int(sys.argv[3]),
+          }
+
+          checks = []
+          for name, code in statuses.items():
+              log = (tmpdir / f"{name}.log").read_text(errors="replace")
+              checks.append({
+                  "name": name,
+                  "status": "passed" if code == 0 else "failed",
+                  "exit_code": code,
+                  "log_tail": log[-12000:],
+              })
+
+          failed = [check for check in checks if check["exit_code"] != 0]
+          print(json.dumps({
+              "status": "passed" if not failed else "failed",
+              "reason": "all validation checks passed" if not failed else "one or more validation checks failed",
+              "checks": checks,
+          }))
+          PY
+          '
+        output: validation
+        timeout: 45m
+    gate:
+      output: validation
+      pass:
+        path: status
+        values: [passed]
+      fail:
+        path: status
+        values: [failed, error]
+      required: true
+
+  - id: fix-validation
+    label: Fix Validation
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: fail
+    on_enter:
+      inject: |
+        Validation failed before completion.
+
+        Status: {{ .Outputs.validation.status }}
+        Reason: {{ .Outputs.validation.reason }}
+
+        Checks:
+        {{ .Outputs.validation.checks }}
+
+        Fix the failures above, commit the changes to the same PR branch, and
+        say [DONE] with the PR URL again when the PR is ready for validation.
+
+  - id: complete
+    label: Complete
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: pass
+    terminal: true
diff --git a/.github/workflows/factory-update.yaml b/.github/workflows/factory-update.yaml
new file mode 100644
index 00000000..433f40bd
--- /dev/null
+++ b/.github/workflows/factory-update.yaml
@@ -0,0 +1,32 @@
+name: Publish ElasticClaw Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".factory-workflows/dependency-update.yaml"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Publish workflow (${{ matrix.workflow }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        workflow:
+          - .factory-workflows/dependency-update.yaml
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Publish workflow (dependency-update)
+        uses: elasticclaw/actions/publish-workflow@main
+        with:
+          hub-endpoint: https://factory.repldev.com
+          token: ${{ secrets.ELASTICCLAW_TOKEN }}
+          workspace: replicated-troubleshoot
+          path: ${{ matrix.workflow }}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 00000000..5bf04ff4
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1783224372,
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 00000000..b4ed9f9e
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,26 @@
+{
+  description = "Troubleshoot development environment";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in {
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            go_1_26
+            git # required for go VCS stamping during build
+            python3 # required by the dependency-update validation stage
+          ];
+
+          shellHook = ''
+            echo "Troubleshoot dev — $(go version)"  # go 1.26.x required
+          '';
+        };
+      });
+}