diff --git a/.github/workflows/stale-pull-requests.yml b/.github/workflows/stale-pull-requests.yml
new file mode 100644
index 0000000..9e3f5b7
--- /dev/null
+++ b/.github/workflows/stale-pull-requests.yml
@@ -0,0 +1,19 @@
+---
+# Temporary repository-local dry-run caller. Organization-wide adoption remains
+# owned by tfroot-github after branch-protection-compatible adoption.
+name: stale-pull-requests
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  stale:
+    uses: makeitworkcloud/shared-workflows/.github/workflows/_stale-pull-requests.yml@e7560bb511468fd800aedbc783d02950d3dff5ca
+    with:
+      dry-run: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5cd20f..f81b751 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,10 @@ exactly that versioned section and publishes it as the GitHub Release body.
 
 ## Unreleased
 
+### Added
+
+- A read-only scheduled dry run that reports stale pull request candidates without changing NetworkManager or Cloudflare DNS configuration.
+
 ## [1.1.0] - 2026-09-02
 
 ### Added