diff --git a/.github/workflows/close-prs.yml b/.github/workflows/close-prs.yml
new file mode 100644
index 0000000..a7f8795
--- /dev/null
+++ b/.github/workflows/close-prs.yml
@@ -0,0 +1,28 @@
+name: Close PRs
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+
+jobs:
+  manage-prs:
+    runs-on: ubuntu-slim
+    steps:
+      - name: "Close PR(s)"
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "${{ github.event.pull_request.number }}"
+          else
+            gh pr list --state open --limit 200 --json number --jq '.[].number'
+          fi | while read pr; do
+            if [ -n "$pr" ]; then
+              echo "Closing PR #$pr"
+              gh pr close $pr --comment "This repository does not accept direct pull requests. See #44 for details."
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-bindgen.yml b/.github/workflows/test-bindgen.yml
index fc4e2a2..b3dc3ee 100644
--- a/.github/workflows/test-bindgen.yml
+++ b/.github/workflows/test-bindgen.yml
@@ -1,20 +1,11 @@
 name: Test `wit-bindgen` against the WIT
 on: [push, pull_request, workflow_dispatch]
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   test-bindgen:
     name: Test with `wit-bindgen`
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup `wit-bindgen`
-        uses: bytecodealliance/actions/wit-bindgen/setup@v1
-
-      - name: Test WIT
-        run: wit-bindgen rust v0.1
+      - uses: actions/checkout@v7
+      - uses: bytecodealliance/actions/wit-bindgen/setup@v1
+      - run: wit-bindgen rust v0.1