diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
new file mode 100644
index 000000000..9cf151ea6
--- /dev/null
+++ b/.github/workflows/stale.yml
@@ -0,0 +1,42 @@
+name: Mark stale issues and pull requests
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 8 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        with:
+          stale-issue-label: state:stale
+          stale-pr-label: state:stale
+
+          days-before-issue-stale: 14
+          days-before-issue-close: -1 # -1 puts this into dry-run mode. Update to 7 to enable closing.
+          days-before-pr-stale: 14
+          days-before-pr-close: -1 # -1 puts this into dry-run mode. Update to 7 to enable closing.
+
+          exempt-issue-labels: state:triage-needed,roadmap
+          close-issue-reason: not_planned
+
+          stale-issue-message: >
+            This issue has had no activity for 14 days and is now marked stale.
+            It may be closed in 7 days if there is no further activity.
+            Comment or remove the state:stale label to keep it open.
+          close-issue-message: >
+            Closing this issue after 7 days with no activity since it was marked stale.
+            Reopen it if the work is still relevant.
+          stale-pr-message: >
+            This pull request has had no activity for 14 days and is now marked stale.
+            It may be closed in 7 days if there is no further activity.
+          close-pr-message: >
+            Closing this pull request after 7 days with no activity since it was marked stale.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 406205c35..07ce1d916 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -94,6 +94,7 @@ Skills connect into pipelines. Individual skill files don't describe these relat
 
 Workflow state labels use the `state:*` prefix, and security work uses `topic:security`. GitHub issue templates assign built-in issue types where applicable, and agent-created issues should use issue types or manual follow-up rather than type labels.
 New issues opened by users without `write`, `maintain`, or `admin` repository permission are automatically labeled `state:triage-needed` by the issue triage workflow.
+Inactive issues and pull requests are automatically labeled `state:stale` after 14 days without activity and may be closed after 7 more days without activity. Comment on the item or remove `state:stale` to keep it open. Issues labeled `state:triage-needed` or `roadmap` are exempt from stale handling.
 
 ## Prerequisites