diff --git a/.github/workflows/ai-review-approvals.yml b/.github/workflows/ai-review-approvals.yml
new file mode 100644
index 00000000..2415bf2e
--- /dev/null
+++ b/.github/workflows/ai-review-approvals.yml
@@ -0,0 +1,16 @@
+name: AI Review (approvals)
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions: {}
+
+jobs:
+  # A review runs the PR's own copy of this workflow, so it only finishes;
+  # AI Review (human gate) then runs from the default branch.
+  reviewed:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - run: echo "AI Review (human gate) re-sets ai-review/human."
diff --git a/.github/workflows/ai-review-human.yml b/.github/workflows/ai-review-human.yml
new file mode 100644
index 00000000..67fef1b2
--- /dev/null
+++ b/.github/workflows/ai-review-human.yml
@@ -0,0 +1,20 @@
+name: AI Review (human gate)
+
+on:
+  workflow_run:
+    workflows: [AI Review (approvals)]
+    types: [completed]
+  pull_request_target:
+    branches: [main]
+    types: [labeled, unlabeled]
+
+permissions: {}
+
+jobs:
+  human-gate:
+    if: github.event_name == 'workflow_run' || github.event.label.name == 'needs-human-review'
+    uses: Kong/volcano-actions/.github/workflows/ai-review-human.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
diff --git a/.github/workflows/ai-review-merge-queue.yml b/.github/workflows/ai-review-merge-queue.yml
new file mode 100644
index 00000000..227d9717
--- /dev/null
+++ b/.github/workflows/ai-review-merge-queue.yml
@@ -0,0 +1,14 @@
+name: AI Review (merge queue)
+
+on:
+  merge_group:
+    branches: [main]
+    types: [checks_requested]
+
+permissions: {}
+
+jobs:
+  pass:
+    uses: Kong/volcano-actions/.github/workflows/ai-review-merge-queue.yml@main
+    permissions:
+      statuses: write
diff --git a/.github/workflows/ai-review-retarget-override.yml b/.github/workflows/ai-review-retarget-override.yml
new file mode 100644
index 00000000..d297916e
--- /dev/null
+++ b/.github/workflows/ai-review-retarget-override.yml
@@ -0,0 +1,20 @@
+name: AI Review (retarget and override)
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [edited, labeled]
+
+permissions: {}
+
+jobs:
+  retarget-or-override:
+    if: github.event.changes.base || github.event.label.name == 'ai-review-override'
+    uses: Kong/volcano-actions/.github/workflows/ai-review.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    secrets:
+      anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
+      codex_access_token: ${{ secrets.CODEX_CI_ACCESS_TOKEN }}
diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
new file mode 100644
index 00000000..768f5159
--- /dev/null
+++ b/.github/workflows/ai-review.yml
@@ -0,0 +1,19 @@
+name: AI Review
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions: {}
+
+jobs:
+  ai-review:
+    uses: Kong/volcano-actions/.github/workflows/ai-review.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    secrets:
+      anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
+      codex_access_token: ${{ secrets.CODEX_CI_ACCESS_TOKEN }}