diff --git a/.github/workflows/openapi-lint.yml b/.github/workflows/openapi-lint.yml
new file mode 100644
index 0000000000..943cd0b9e2
--- /dev/null
+++ b/.github/workflows/openapi-lint.yml
@@ -0,0 +1,15 @@
+name: openapi-lint
+on:
+  pull_request:
+    paths:
+      - 'docs/static/spec/openapi/logstash-api.yaml'
+permissions:
+  contents: read
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: elastic/docs-actions/openapi/lint@v1
+        with:
+          spec-path: docs/static/spec/openapi/logstash-api.yaml
diff --git a/.github/workflows/openapi-publish.yml b/.github/workflows/openapi-publish.yml
new file mode 100644
index 0000000000..f52d5afab7
--- /dev/null
+++ b/.github/workflows/openapi-publish.yml
@@ -0,0 +1,27 @@
+name: openapi-publish
+on:
+  push:
+    branches:
+      - main
+      - '[0-9]+.[0-9]+'
+    paths:
+      - 'docs/static/spec/openapi/logstash-api.yaml'
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for OIDC to AWS in openapi/upload
+    steps:
+      - uses: actions/checkout@v7
+      - uses: elastic/docs-actions/openapi/lint@v1
+        with:
+          spec-path: docs/static/spec/openapi/logstash-api.yaml
+      - uses: elastic/docs-actions/openapi/upload@v1
+        with:
+          spec-path: docs/static/spec/openapi/logstash-api.yaml
+          spec-name: logstash