diff --git a/.github/workflows/release-main-and-preview.yml b/.github/workflows/release-main-and-preview.yml
index dab14cbd4..688965258 100644
--- a/.github/workflows/release-main-and-preview.yml
+++ b/.github/workflows/release-main-and-preview.yml
@@ -40,6 +40,11 @@ on:
         required: false
         type: boolean
         default: false
+      cdk_dist_tag:
+        description: '@aws/agentcore-cdk npm dist-tag to pin the vended CDK template to (default: latest)'
+        required: false
+        type: string
+        default: 'latest'
 
 permissions:
   contents: write
@@ -135,6 +140,13 @@ jobs:
           echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
           echo "📦 Preview version: $NEW_VERSION"
 
+      - name: Sync vended CDK version
+        env:
+          CDK_DIST_TAG: ${{ github.event.inputs.cdk_dist_tag }}
+        run: |
+          npx tsx scripts/sync-vended-cdk.ts --tag "${CDK_DIST_TAG:-latest}"
+          npx prettier --write src/assets/cdk/package.json
+
       - name: Regenerate JSON schema
         run: |
           npm run build
diff --git a/scripts/sync-vended-cdk.ts b/scripts/sync-vended-cdk.ts
new file mode 100644
index 000000000..1baaf7a97
--- /dev/null
+++ b/scripts/sync-vended-cdk.ts
@@ -0,0 +1,49 @@
+#!/usr/bin/env npx tsx
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import * as path from 'node:path';
+
+const CDK_PACKAGE = '@aws/agentcore-cdk';
+const TEMPLATE_PATH = path.resolve(__dirname, '../src/assets/cdk/package.json');
+
+function getFlagValue(flag: string): string | undefined {
+  const index = process.argv.indexOf(flag);
+  return index !== -1 ? process.argv[index + 1] : undefined;
+}
+
+function resolveTargetVersion(): string {
+  const explicit = getFlagValue('--to');
+  if (explicit) {
+    return explicit;
+  }
+  const tag = getFlagValue('--tag') ?? 'latest';
+  const version = execFileSync('npm', ['view', `${CDK_PACKAGE}@${tag}`, 'version'], { encoding: 'utf-8' }).trim();
+  if (!version) {
+    throw new Error(`could not resolve ${CDK_PACKAGE}@${tag} from npm`);
+  }
+  return version;
+}
+
+function main(): void {
+  const dryRun = process.argv.includes('--dry-run');
+  const target = resolveTargetVersion();
+
+  const pkg = JSON.parse(readFileSync(TEMPLATE_PATH, 'utf-8')) as { dependencies: Record<string, string> };
+  const current = pkg.dependencies[CDK_PACKAGE];
+
+  if (current === target) {
+    console.log(`${CDK_PACKAGE} already pinned to ${target} — no change`);
+    return;
+  }
+  if (dryRun) {
+    console.log(`[dry-run] ${CDK_PACKAGE}: ${current} -> ${target}`);
+    return;
+  }
+
+  pkg.dependencies[CDK_PACKAGE] = target;
+  writeFileSync(TEMPLATE_PATH, JSON.stringify(pkg, null, 2) + '\n');
+  console.log(`${CDK_PACKAGE}: ${current} -> ${target}`);
+}
+
+main();