diff --git a/workflow-pr/main.go b/workflow-pr/main.go
index ae4e86e..778de2a 100644
--- a/workflow-pr/main.go
+++ b/workflow-pr/main.go
@@ -248,6 +248,7 @@ func verifyProjectState(git *common.GitHandler, orgName string, config *common.A
 
 nextSubmodule:
 	for sub, commitID := range submodules {
+		log.Println("  + checking", sub, commitID)
 		submoduleName := sub
 		if n := strings.LastIndex(sub, "/"); n != -1 {
 			submoduleName = sub[n+1:]
@@ -268,6 +269,18 @@ nextSubmodule:
 		}
 
 		// not found in past, check if we should advance the branch label ... pull the submodule
+		git.GitExecOrPanic(config.GitProjectName, "submodule", "update", "--init", "--filter", "blob:none", "--", sub)
+		subDir := path.Join(config.GitProjectName, sub)
+		newCommits := git.GitExecWithOutputOrPanic(subDir, "rev-list", "^origin/"+config.Branch, commitID)
+		if len(common.SplitStringNoEmpty(newCommits, "\n")) >= 1 {
+			sshUrl, err := git.translateHttpsToSshUrl(git.SubmoduleUrl(config.GitProjectName), sub)
+			if err != nil {
+				return fmt.Errorf("Cannot traslate HTTPS git URL to SSH_URL. %w", err)
+			}
+			git.GitExecOrPanic(subDir, "checkout", "-B", config.Branch, commitID)
+			git.GitExecOrPanic(subDir, "remote", "add", "update", sshUrl)
+			git.GitExecOrPanic(subDir, "push", "update", config.Branch)
+		}
 	}
 
 	// forward any package-gits referred by the project git, but don't go back
@@ -289,7 +302,9 @@ func checkRepos() {
 				log.Println("Faield to allocate GitHandler:", err)
 				return
 			}
-			defer git.Close()
+			if !DebugMode {
+				defer git.Close()
+			}
 			if err := verifyProjectState(git, org, config, configs); err != nil {
 				log.Printf(" *** verification failed, org: `%s`, err: %#v\n", org, err)
 			}