diff --git a/.github/workflows/insight-sync.yml b/.github/workflows/insight-sync.yml
new file mode 100644
index 0000000..e8315a3
--- /dev/null
+++ b/.github/workflows/insight-sync.yml
@@ -0,0 +1,67 @@
+name: insight-sync
+
+# On-demand durable sync of the insight stream: pull the collector's decisions
+# and operator labels into ledger/insights/ and open a REVIEWED PR. This is the
+# target of the Observatory "Sync now" button (agentic-observatory) and a
+# manual complement to the nightly on-box knowledge-loop sync
+# (network-operations#428).
+#
+# Runs on the self-hosted hyrule-infra runner because the collector
+# (http://[loop]:8770) is firewalled to loop/noc/mon; GitHub-hosted runners
+# cannot reach it. REQUIRES a ci -> collector:8770 firewall rule in
+# network-operations (loop.yml) — until that lands the sync step will fail to
+# connect. Writes nothing directly: the ledger change lands as a reviewed PR.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: insight-sync
+  cancel-in-progress: false
+
+jobs:
+  insight-sync:
+    runs-on: [self-hosted, linux, x64, hyrule-infra]
+    env:
+      GH_TOKEN: ${{ secrets.KNOWLEDGE_GH_TOKEN }}
+      FALLBACK_GH_TOKEN: ${{ github.token }}
+      # GET /v1/insights is unauthenticated (reads are open); no token needed.
+      HYRULE_KNOWLEDGE_LOOP_INSIGHT_COLLECTOR_URL: http://[2a0c:b641:b50:2::f0]:8770
+    steps:
+      - name: Select GitHub token
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "GH_TOKEN=${FALLBACK_GH_TOKEN}" >> "$GITHUB_ENV"
+          fi
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --group dev --frozen
+      - name: Sync collector insights into the ledger
+        run: |
+          uv run hyrule-knowledge insights sync \
+            --collector-url "$HYRULE_KNOWLEDGE_LOOP_INSIGHT_COLLECTOR_URL"
+      - name: Validate the refreshed ledger + exports
+        run: |
+          uv run hyrule-knowledge validate okf
+          uv run hyrule-knowledge quality --check
+          uv run hyrule-knowledge export --check
+          uv run hyrule-knowledge scan-secrets okf exports reports
+      - name: Open reviewed insight-sync pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          branch: bot/knowledge-refresh/insight-sync-${{ github.run_id }}
+          title: "knowledge: insight-sync ${{ github.run_id }}"
+          commit-message: "knowledge: sync collector insights into ledger"
+          body: |
+            On-demand durable sync of the insight decision/label stream from the
+            collector into `ledger/insights/`. Deterministic; review the ledger
+            diff (decisions + operator labels) before merge.
+          labels: knowledge, automated
+          delete-branch: true