diff --git a/.github/workflows/update-lucide.yml b/.github/workflows/update-lucide.yml
index 216c0a6..83b67eb 100644
--- a/.github/workflows/update-lucide.yml
+++ b/.github/workflows/update-lucide.yml
@@ -13,6 +13,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      issues: write
 
     steps:
     - name: Checkout repository
@@ -133,9 +134,26 @@ jobs:
       if: steps.version-check.outputs.needs-update == 'true' && steps.check-pr.outputs.pr-exists == 'false'
       env:
         GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+        GH_TOKEN: ${{ github.token }}
       run: |
-        echo "🔍 Generating semantic search data for new icons..."
-        make search-data
+        if [ -z "$GEMINI_API_KEY" ]; then
+          echo "::warning::GEMINI_API_KEY not set — skipping search data so the icon update can still land. New icons will be missing from semantic search until the key is restored."
+          # A green run with a buried warning is how the last outage stayed
+          # invisible for 5 weeks — file the ci-failure issue even on success.
+          title="CI failure: ${{ github.workflow }} (GEMINI_API_KEY missing)"
+          run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          existing=$(gh issue list --repo "${{ github.repository }}" --label ci-failure --state open \
+            --search "\"$title\" in:title" --json number --jq '.[0].number // empty')
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --repo "${{ github.repository }}" --body "Still missing: $run_url"
+          else
+            gh issue create --repo "${{ github.repository }}" --label ci-failure --title "$title" \
+              --body "GEMINI_API_KEY repo secret is not set. Icon updates still land, but new icons are skipped from semantic search. Restore from sops key PYTHON_LUCIDE_CI_GEMINI_API_KEY (secrets/infrastructure/llm-providers.sops.yaml). Run: $run_url"
+          fi
+        else
+          echo "🔍 Generating semantic search data for new icons..."
+          make search-data
+        fi
         SEARCH_DB=src/lucide/data/lucide-search.db
         if [ -f "$SEARCH_DB" ]; then
           DESC_COUNT=$(sqlite3 "$SEARCH_DB" "SELECT COUNT(*) FROM icon_descriptions;")
@@ -261,3 +279,21 @@ jobs:
         else
           echo "- **Status**: ✅ Already up to date" >> $GITHUB_STEP_SUMMARY
         fi
+
+    - name: Open issue on failure
+      if: failure()
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        title="CI failure: ${{ github.workflow }}"
+        run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+        existing=$(gh issue list --repo "${{ github.repository }}" --label ci-failure --state open \
+          --search "\"$title\" in:title" --json number --jq '.[0].number // empty')
+        if [ -n "$existing" ]; then
+          gh issue comment "$existing" --repo "${{ github.repository }}" --body "Still failing: $run_url"
+        else
+          gh issue create --repo "${{ github.repository }}" --label ci-failure --title "$title" \
+            --body "Automated housekeeping workflow failed. Latest run: $run_url
+
+        Surfaced by the /prs weekly review. Close when the workflow is green again."
+        fi
diff --git a/.github/workflows/update-pre-commit-hooks.yaml b/.github/workflows/update-pre-commit-hooks.yaml
index 41c2f59..1251cd9 100644
--- a/.github/workflows/update-pre-commit-hooks.yaml
+++ b/.github/workflows/update-pre-commit-hooks.yaml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  issues: write
 
 jobs:
   update-hooks:
@@ -136,3 +137,21 @@ jobs:
     - name: Clean up
       if: always()
       run: rm -f .pre-commit-config.yaml.bak
+
+    - name: Open issue on failure
+      if: failure()
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        title="CI failure: ${{ github.workflow }}"
+        run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+        existing=$(gh issue list --repo "${{ github.repository }}" --label ci-failure --state open \
+          --search "\"$title\" in:title" --json number --jq '.[0].number // empty')
+        if [ -n "$existing" ]; then
+          gh issue comment "$existing" --repo "${{ github.repository }}" --body "Still failing: $run_url"
+        else
+          gh issue create --repo "${{ github.repository }}" --label ci-failure --title "$title" \
+            --body "Automated housekeeping workflow failed. Latest run: $run_url
+
+        Surfaced by the /prs weekly review. Close when the workflow is green again."
+        fi