diff --git a/.github/workflows/update-cli-reference.yml b/.github/workflows/update-cli-reference.yml
deleted file mode 100644
index ff795083a..000000000
--- a/.github/workflows/update-cli-reference.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Update the CLI reference page of the documentation
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - "cli/cmd/**"
-      - "cli/internal/cmd/**"
-      - "hack/clidocgen/**"
-      - ".github/workflows/update-cli-reference.yml"
-
-jobs:
-  update-docs:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout Constellation
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
-        with:
-          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
-
-      - name: Setup Go environment
-        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
-        with:
-          go-version: "1.20.2"
-          cache: true
-
-      - name: Regenerate CLI reference of the documentation
-        working-directory: hack/clidocgen
-        run: go run . | cat header.md - > ../../docs/docs/reference/cli.md
-
-      - name: Create PR (if there are changes)
-        uses: peter-evans/create-pull-request@38e0b6e68b4c852a5500a94740f0e535e0d7ba54 # v4.2.4
-        with:
-          branch: ci/cli-ref/update
-          base: main
-          title: "docs: update cli reference"
-          body: |
-            :robot: *This is an automated PR.* :robot:
-
-            Changes in the CLI triggered this PR, it updates the corresponding documentation page.
-
-            If there is anything wrong with the content of this PR, **please don't do changes on this PR**,
-            rather make the changes in the CLI code and open a separate PR.
-            You can leave this PR open (it will be updated, use a "hold" label) or close it (a new PR will
-            be created automatically on new changes on main).
-          commit-message: "docs: update cli reference"
-          committer: edgelessci <edgelessci@users.noreply.github.com>
-          labels: no changelog
-          # We need to push changes using a token, otherwise triggers like on:push and on:pull_request won't work.
-          token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}
diff --git a/bazel/ci/BUILD.bazel b/bazel/ci/BUILD.bazel
index 0b110ca4c..a276c41a0 100644
--- a/bazel/ci/BUILD.bazel
+++ b/bazel/ci/BUILD.bazel
@@ -381,6 +381,17 @@ multirun(
     jobs = 0,  # execute concurrently
 )
 
+sh_template(
+    name = "cli_docgen",
+    data = [
+        "//hack/clidocgen",
+    ],
+    substitutions = {
+        "@@CLIDOCGEN@@": "$(rootpath //hack/clidocgen:clidocgen)",
+    },
+    template = "cli_docgen.sh.in",
+)
+
 multirun(
     name = "tidy",
     commands = [
@@ -432,6 +443,7 @@ multirun(
         "//3rdparty/bazel/com_github_medik8s_node_maintainance_operator:pull_files",
         ":go_generate",
         ":proto_generate",
+        ":cli_docgen",
     ],
     jobs = 1,  # execute sequentially
     visibility = ["//visibility:public"],
diff --git a/bazel/ci/cli_docgen.sh.in b/bazel/ci/cli_docgen.sh.in
new file mode 100644
index 000000000..5dc6a2f42
--- /dev/null
+++ b/bazel/ci/cli_docgen.sh.in
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+###### script header ######
+
+lib=$(realpath @@BASE_LIB@@) || exit 1
+stat "${lib}" >> /dev/null || exit 1
+
+# shellcheck source=../sh/lib.bash
+if ! source "${lib}"; then
+  echo "Error: could not find import"
+  exit 1
+fi
+
+clidocgen=$(realpath @@CLIDOCGEN@@)
+stat "${clidocgen}" >> /dev/null
+
+cd "${BUILD_WORKSPACE_DIRECTORY}"
+
+###### script body ######
+
+cd hack/clidocgen
+${clidocgen} | cat header.md - > ../../docs/docs/reference/cli.md