diff --git a/.github/workflows/versions.yml b/.github/workflows/versions.yml
new file mode 100644
index 0000000000000000000000000000000000000000..57dbdb3f06423e789472ad3f6a9fe69dc83bec0f
--- /dev/null
+++ b/.github/workflows/versions.yml
@@ -0,0 +1,15 @@
+name: Pull request labeler
+on:
+  schedule:
+    - cron: '18 8 * * *'
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - uses: actions/setup-go@v2
+    - uses: romoh/dependencies-autoupdate@v1.1
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        update-command: './scripts/generate-versions.sh > jsonnet/kube-prometheus/versions.json'
+        on-changes-command: 'make --always-make generate'
diff --git a/jsonnet/kube-prometheus/main.libsonnet b/jsonnet/kube-prometheus/main.libsonnet
index 70775716a2bfc00cbb2a47aaab64a9193ab35ccb..f288159d4f61fcd58c5102dd2bb76e77e40f2a65 100644
--- a/jsonnet/kube-prometheus/main.libsonnet
+++ b/jsonnet/kube-prometheus/main.libsonnet
@@ -18,16 +18,17 @@ local prometheus = import './components/prometheus.libsonnet';
         role: 'alert-rules',
         prometheus: $.values.prometheus.name,
       },
+      // to allow automatic upgrades of components, we store versions in autogenerated `versions.json` file and import it here
       versions: {
-        alertmanager: '0.21.0',
-        blackboxExporter: '0.18.0',
-        grafana: '7.3.7',
-        kubeStateMetrics: '1.9.8',
-        nodeExporter: '1.1.0',
-        prometheus: '2.24.0',
-        prometheusAdapter: '0.8.3',
-        prometheusOperator: '0.45.0',
-      },
+        alertmanager: error 'must provide version',
+        blackboxExporter: error 'must provide version',
+        grafana: error 'must provide version',
+        kubeStateMetrics: '1.9.8',  // FIXME(paulfantom): needs https://github.com/kubernetes/kube-state-metrics/issues/1392
+        nodeExporter: error 'must provide version',
+        prometheus: error 'must provide version',
+        prometheusAdapter: error 'must provide version',
+        prometheusOperator: error 'must provide version',
+      } + (import 'versions.json'),
       images: {
         alertmanager: 'quay.io/prometheus/alertmanager:v' + $.values.common.versions.alertmanager,
         blackboxExporter: 'quay.io/prometheus/blackbox-exporter:v' + $.values.common.versions.blackboxExporter,
diff --git a/jsonnet/kube-prometheus/versions.json b/jsonnet/kube-prometheus/versions.json
new file mode 100644
index 0000000000000000000000000000000000000000..cbfa4254b36a92b2090c72c0f4bb453d0eed6c8e
--- /dev/null
+++ b/jsonnet/kube-prometheus/versions.json
@@ -0,0 +1,9 @@
+{
+  "alertmanager": "0.21.0",
+  "blackboxExporter": "0.18.0",
+  "grafana": "7.3.7",
+  "nodeExporter": "1.1.0",
+  "prometheus": "2.24.0",
+  "prometheusAdapter": "0.8.3",
+  "prometheusOperator": "0.45.0" 
+}
diff --git a/scripts/generate-versions.sh b/scripts/generate-versions.sh
new file mode 100755
index 0000000000000000000000000000000000000000..8505f6d862efa60b62d2c63da75c8a3cf4c86ea9
--- /dev/null
+++ b/scripts/generate-versions.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+get_latest_version() {
+  curl --retry 5 --silent -H "Authorization: token $token" "https://api.github.com/repos/${1}/releases/latest" | jq '.tag_name' | tr -d '"v'
+}
+
+# token can be passed as `GITHUB_TOKEN` or `token` variable
+token=${token:-${GITHUB_TOKEN}}
+
+if [ -z "$token" ]; then
+	echo "GITHUB_TOKEN not set. Exiting"
+	exit 1
+fi
+
+cat <<-EOF
+{
+  "alertmanager": "$(get_latest_version "prometheus/alertmanager")"
+  "blackboxExporter": "$(get_latest_version "prometheus/blackbox_exporter")",
+  "grafana": "$(get_latest_version "grafana/grafana")",
+  "nodeExporter": "$(get_latest_version "prometheus/node_exporter")",
+  "prometheus": "$(get_latest_version "prometheus/prometheus")",
+  "prometheusAdapter": "$(get_latest_version "kubernetes-sigs/prometheus-adapter")",
+  "prometheusOperator": "$(get_latest_version "prometheus-operator/prometheus-operator")"
+}
+EOF