diff --git a/.github/actions/report-failure/action.yml b/.github/actions/report-failure/action.yml
new file mode 100644
index 00000000000..ef63226e162
--- /dev/null
+++ b/.github/actions/report-failure/action.yml
@@ -0,0 +1,45 @@
+name: 'Report failure'
+description: >-
+  Track failures of a scheduled workflow in a single open issue: open it on the
+  first failure and comment on it for every subsequent one until someone closes
+  it. Run this as the last step with "if: failure()".
+  Requires the calling job to have "permissions: issues: write".
+
+inputs:
+  label:
+    description: Label that identifies the failure-tracking issue for this workflow.
+    required: true
+  assignees:
+    description: Comma-separated GitHub users to assign to a newly opened issue.
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Open or update failure issue
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        GH_REPO: ${{ github.repository }}
+        LABEL: ${{ inputs.label }}
+        ASSIGNEES: ${{ inputs.assignees }}
+        WORKFLOW: ${{ github.workflow }}
+        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |-
+        set -euo pipefail
+        gh label create "$LABEL" --force \
+          --color B60205 \
+          --description "The $WORKFLOW workflow is failing"
+        issue="$(gh issue list --label "$LABEL" --state open --json number --jq '.[0].number // empty')"
+        if [ -n "$issue" ]; then
+          gh issue comment "$issue" --body "Failed again: $RUN_URL"
+        else
+          # Assign individuals: a team mention posted by github-actions does not
+          # notify the team's members.
+          gh issue create --label "$LABEL" \
+            --assignee "$ASSIGNEES" \
+            --title "$WORKFLOW workflow is failing" \
+            --body "@databricks/eng-deco-cli the scheduled \`$WORKFLOW\` workflow failed.
+
+        $RUN_URL"
+        fi
diff --git a/.github/workflows/bump-go-toolchain.yml b/.github/workflows/bump-go-toolchain.yml
index eee8d4afb57..9e3c0ee8602 100644
--- a/.github/workflows/bump-go-toolchain.yml
+++ b/.github/workflows/bump-go-toolchain.yml
@@ -16,6 +16,9 @@ permissions:
   contents: write
   pull-requests: write
 
+  # Required to open or comment on the failure-tracking issue.
+  issues: write
+
 jobs:
   bump-go-toolchain:
     runs-on:
@@ -125,3 +128,11 @@ jobs:
               -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
               commit -m "Add changelog fragment"
           git push origin "HEAD:$BRANCH"
+
+      # A failed scheduled run is otherwise only visible in the Actions tab.
+      - name: Report failure
+        if: failure()
+        uses: ./.github/actions/report-failure
+        with:
+          label: bump-go-toolchain-failure
+          assignees: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka
diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml
index 05fd08a6d6c..bb8f6affcca 100644
--- a/.github/workflows/bump-vuln-deps.yml
+++ b/.github/workflows/bump-vuln-deps.yml
@@ -10,6 +10,9 @@ permissions:
   contents: write
   pull-requests: write
 
+  # Required to open or comment on the failure-tracking issue.
+  issues: write
+
   # Required by setup-jfrog (GOPROXY exchange).
   id-token: write
 
@@ -120,3 +123,11 @@ jobs:
               -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
               commit -m "Add changelog fragment"
           git push origin "HEAD:$BRANCH"
+
+      # A failed scheduled run is otherwise only visible in the Actions tab.
+      - name: Report failure
+        if: failure()
+        uses: ./.github/actions/report-failure
+        with:
+          label: bump-vuln-deps-failure
+          assignees: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka