diff --git a/Makefile.core.mk b/Makefile.core.mk
index 94acbf9fa..ac306ef03 100644
--- a/Makefile.core.mk
+++ b/Makefile.core.mk
@@ -461,7 +461,7 @@ bundle: gen helm operator-sdk ## Generate bundle manifests and metadata, then va
 		if (git ls-files --error-unmatch "$$csvPath" &>/dev/null); then \
 			if ! (git diff "$$csvPath" | grep '^[+-][^+-][^+-]' | grep -v "createdAt:" >/dev/null); then \
 				echo "reverting timestamp change in $$csvPath"; \
-				git checkout "$$csvPath"; \
+				git checkout "$$csvPath" || echo "failed to revert timestamp change. assuming we're in the middle of a merge"; \
 			fi \
 		fi
 	$(OPERATOR_SDK) bundle validate ./bundle
diff --git a/ossm/merge_upstream.sh b/ossm/merge_upstream.sh
new file mode 100755
index 000000000..19772f4c3
--- /dev/null
+++ b/ossm/merge_upstream.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+# Copyright Istio Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+if [ -e "$GITHUB_TOKEN_PATH" ]; then
+  GITHUB_TOKEN=${GITHUB_TOKEN:-"$(cat "$GITHUB_TOKEN_PATH")"}
+fi
+
+GITHUB_TOKEN=${GITHUB_TOKEN:-""}
+
+if [ -z "${GIT_USERNAME:-}" ]; then
+  GIT_USERNAME="$(curl -sSfLH "Authorization: token $GITHUB_TOKEN" "https://api.github.com/user" | jq --raw-output ".login")"
+fi
+
+if [ -z "${GIT_EMAIL:-}" ]; then
+  GIT_EMAIL="$(curl -sSfLH "Authorization: token $GITHUB_TOKEN" "https://api.github.com/user" | jq --raw-output ".email")"
+fi
+
+GIT_COMMIT_MESSAGE=${GIT_COMMIT_MESSAGE:-"Automated merge"}
+
+MERGE_STRATEGY=${MERGE_STRATEGY:-"merge"}
+MERGE_REPOSITORY=${MERGE_REPOSITORY:-"git@github.com:istio-ecosystem/sail-operator.git"}
+MERGE_BRANCH=${MERGE_BRANCH:-"main"}
+
+print_error() {
+  local last_return="$?"
+
+  {
+    echo
+    echo "${1:-unknown error}"
+    echo
+  } >&2
+
+  return "${2:-$last_return}"
+}
+
+merge() {
+  git remote add -f -t "$MERGE_BRANCH" upstream "$MERGE_REPOSITORY"
+  echo "Using branch $MERGE_BRANCH"
+
+  set +e # git returns a non-zero exit code on merge failure, which fails the script
+  if [ "${MERGE_STRATEGY}" == "merge" ]; then
+    git -c "user.name=$GIT_USERNAME" -c "user.email=$GIT_EMAIL" merge --no-ff -m "$GIT_COMMIT_MESSAGE" --log upstream/"$MERGE_BRANCH"
+  else
+    git -c "user.name=$GIT_USERNAME" -c "user.email=$GIT_EMAIL" rebase upstream/"$MERGE_BRANCH"
+  fi
+  return $?
+}
+
+main () {  
+  if ! merge; then
+    set -e
+    echo "Conflicts detected, attempting to run 'make gen' to resolve."
+    rm -rf bundle resources
+    make gen
+    git add bundle resources chart
+    git -c "user.name=$GIT_USERNAME" -c "user.email=$GIT_EMAIL" commit --no-edit
+  fi
+}
+
+main