diff --git a/.github/workflows/update-googleapis-sha.yml b/.github/workflows/update-googleapis-sha.yml
index a6e2775b164b..c07f32a99ea3 100644
--- a/.github/workflows/update-googleapis-sha.yml
+++ b/.github/workflows/update-googleapis-sha.yml
@@ -23,39 +23,93 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Get current date
+      - name: Store the current date as an environment variable
         run: echo "DATE=$(date +'%Y-%m-%d')" >> $GITHUB_ENV
       - name: 'Authenticate to GCP'
         uses: google-github-actions/auth@v1
+        # We can't use WIF since one of the steps needs access to create a storage project.
         with:
           create_credentials_file: true
-          credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
+          credentials_json: ${{ secrets.GHA_STORAGE_SERVICE_ACCOUNT_CREDENTIALS_JSON }}
       - name: 'Set up Cloud SDK'
         uses: google-github-actions/setup-gcloud@v1
         with: 
           version: '>= 390.0.0'
-      - name: Get SHA for google apis 
+      - name: Get latest commit from google apis 
         run: |
           echo "COMMIT=$(curl -fsSL -H 'Accept: application/vnd.github.VERSION.sha' 'https://api.github.com/repos/${{ env.REPO }}/commits/${{ env.BRANCH}}')" >> $GITHUB_ENV 
-      - name: Get SHA for google apis 
+      - name: Get the SHA for google apis and store the archieve in our storage bucket
         run: |
           DOWNLOAD="$(mktemp)"
           curl -fsSL "https://github.com/${{ env.REPO }}/archive/${{ env.COMMIT }}.tar.gz" -o "${DOWNLOAD}" 
           gsutil -q cp "${DOWNLOAD}" "gs://cloud-cpp-community-archive/com_google_googleapis/${{ env.COMMIT }}.tar.gz" 
           echo 'SHA256=$(sha256sum "${DOWNLOAD}" | sed "s/ .*//")'  >> $GITHUB_ENV
           rm -rf ${DOWNLOAD}
-      - name: Run `renovate.sh` script
-        run: TERM=xterm ./external/googleapis/renovate.sh
+      - name: Updating Bazel dependencies
+        run: |
+          sed -i -f - bazel/google_cloud_cpp_deps.bzl <<EOT
+          /name = "com_google_googleapis",/,/strip_prefix = "/ {
+          s;/com_google_googleapis/.*.tar.gz",;/com_google_googleapis/${COMMIT}.tar.gz",;
+          s;/${REPO}/archive/.*.tar.gz",;/${REPO}/archive/${COMMIT}.tar.gz",;
+          s/sha256 = ".*",/sha256 = "${SHA256}",/
+          s/strip_prefix = "googleapis-.*",/strip_prefix = "googleapis-${COMMIT}",/
+          }
+          EOT
+        env:
+          COMMIT: ${{ env.COMMIT }}                    
+          REPO: ${{ env.REPO }}          
+          SHA256: ${{ vars.SHA256 }}
+      - name: Updating CMake dependencies
+        run: |
+          sed -i -f - cmake/GoogleapisConfig.cmake <<EOT
+          /^set(_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA$/ {
+          n
+          s/".*"/"${COMMIT}"/
+          }
+          /^set(_GOOGLE_CLOUD_CPP_GOOGLEAPIS_SHA256$/ {
+          n
+          s/".*"/"${SHA256}"/
+          }
+          EOT
         env:
+          COMMIT: ${{ env.COMMIT }}                    
           SHA256: ${{ vars.SHA256 }}
+      - id: s1
+        name: Early exit
+        run: # exit_with_success
+      - id: s2
+      - name: Check if there are any updates
+        id: diff-deps
+        run: |
+          if [[ git diff --quiet bazel/google_cloud_cpp_deps.bzl \
+          cmake/GoogleapisConfig.cmake ]]; then
+          echo "No updates"
+          exit 0
+          fi
+      - name: Updating the protodeps/protolists
+        run: external/googleapis/update_libraries.sh
+      - name: Regenerating libraries
+        run: | # generate-libraries fails if it creates a diff, so ignore its status.
+          ci/cloudbuild/build.sh --docker --trigger=generate-libraries-pr || true
       - name: Verify everything compiles with Bazel
         run: bazel build //google/cloud/...
       - name: Verify everything compiles with CMake
         run: ci/cloudbuild/build.sh -t cmake-install-pr
+      - name: Create commits
+        run: |
+          git commit -m"chore: update googleapis SHA circa $(date +%Y-%m-%d)" \
+          bazel/google_cloud_cpp_deps.bzl cmake/GoogleapisConfig.cmake
+          if ! git diff --quiet external/googleapis/protodeps \
+          external/googleapis/protolists; then
+          git commit -m"Update the protodeps/protolists" \
+            external/googleapis/protodeps external/googleapis/protolists
+          fi
+          if ! git diff --quiet .; then
+          git commit -m"Regenerate libraries" .
+          fi
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v5
         with:
-          commit-message: 'chore(googleapis-sha): update the sha circa ${{ env.DATE }}' 
           title: 'chore(googleapis-sha): update the sha circa ${{ env.DATE }}'
           body: >
             This PR is auto-generated by 
diff --git a/external/googleapis/renovate.sh b/external/googleapis/renovate.sh
index ab1b5e24ce00..cf32ea2086b5 100755
--- a/external/googleapis/renovate.sh
+++ b/external/googleapis/renovate.sh
@@ -24,6 +24,17 @@ function banner() {
   SEPARATOR=Y
 }
 
+banner "Determining googleapis HEAD commit and tarball checksum"
+REPO="googleapis/googleapis"
+BRANCH="master"
+COMMIT=$(curl -fsSL -H "Accept: application/vnd.github.VERSION.sha" \
+  "https://api.github.com/repos/${REPO}/commits/${BRANCH}")
+DOWNLOAD="$(mktemp)"
+curl -fsSL "https://github.com/${REPO}/archive/${COMMIT}.tar.gz" -o "${DOWNLOAD}"
+gsutil -q cp "${DOWNLOAD}" "gs://cloud-cpp-community-archive/com_google_googleapis/${COMMIT}.tar.gz"
+SHA256=$(sha256sum "${DOWNLOAD}" | sed "s/ .*//")
+rm -f "${DOWNLOAD}"
+
 banner "Updating Bazel/CMake dependencies"
 sed -i -f - bazel/google_cloud_cpp_deps.bzl <<EOT
   /name = "com_google_googleapis",/,/strip_prefix = "/ {