diff --git a/.github/workflows/vendor.yaml b/.github/workflows/vendor.yaml
index 65b4adbec..fc62d7f7c 100644
--- a/.github/workflows/vendor.yaml
+++ b/.github/workflows/vendor.yaml
@@ -35,33 +35,29 @@ jobs:
 
       - uses: ./.github/workflows/git-identity
 
-      - name: Check out or create vendor branch
+      - name: Vendor sources
         id: vendor
         run: |
-          set -x
-          if ! git checkout vendor; then
-            git checkout -b vendor
-            git push -u origin HEAD
+          git pull --rebase
+          ./vendor-one.sh .git/duckdb
+          rm -rf .git/duckdb
+          git push --dry-run
+          # Check if ahead of upstream branch
+          # If yes, set a step output
+          if [ $(git rev-list HEAD...origin/main --count) -gt 0 ]; then
+            # Avoid set-output, it's deprecated
+            echo "vendor=ok" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Vendor sources
+      - name: Create PR
+        if: steps.vendor.outputs.vendor != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git push --dry-run
-
-          # Repeat indefinitely until all commits have been vendored
-          # https://stackoverflow.com/a/13252187/946850
-          while :; do
-            ./vendor-one.sh .git/duckdb
-            # Check if ahead of upstream branch
-            # If yes, push and run workflow
-            if [ $(git rev-list HEAD...origin/vendor --count) -gt 0 ]; then
-              git push -u origin HEAD
-              gh workflow run rcc -f ref=vendor
-            else
-              break
-            fi
-          done
-
-          rm -rf .git/duckdb
+          set -x
+          git checkout -b vendor
+          if git push -u origin HEAD; then
+            gh pr create --fill-first
+            gh workflow run rcc -f ref=vendor
+            gh pr merge --auto --squash
+          fi
diff --git a/vendor-one.sh b/vendor-one.sh
index 967eec93e..dde88ebb7 100755
--- a/vendor-one.sh
+++ b/vendor-one.sh
@@ -71,6 +71,19 @@ if [ "$message" = "" ]; then
   exit 0
 fi
 
+our_tag=$(git describe --tags --abbrev=0 | sed -r 's/-[0-9]$//')
+upstream_tag=$(git -C "$upstream_dir" describe --tags --abbrev=0)
+
+echo "Our tag: $our_tag"
+echo "Upstream tag: $upstream_tag"
+
+if [ -z "${is_tag}" -a "${our_tag#$upstream_tag}" == "$our_tag" ]; then
+  echo "Not vendoring because our tag $our_tag does not start with upstream tag $upstream_tag"
+  git checkout -- src/duckdb
+  rm -rf "$upstream_dir"
+  exit 0
+fi
+
 git add .
 
 (
@@ -79,6 +92,4 @@ git add .
   git -C "$upstream_dir" log --first-parent --format="%s" ${base}..${commit} | tee /dev/stderr | sed -r 's%(#[0-9]+)%duckdb/duckdb\1%g'
 ) | git commit --file /dev/stdin
 
-if [ "$upstream_basedir" != ".git/duckdb" ]; then
-  rm -rf "$upstream_dir"
-fi
+rm -rf "$upstream_dir"