diff --git a/.forgejo/workflows/mirror-sync.yaml b/.forgejo/workflows/mirror-sync.yaml
new file mode 100644
index 0000000..cbfff0a
--- /dev/null
+++ b/.forgejo/workflows/mirror-sync.yaml
@@ -0,0 +1,93 @@
+# Mirror Sync — Spork Strategy
+#
+# Keeps the 'main' branch tracking upstream (via mirror) and
+# rebases the 'blumeops' branch on top. See docs/explanation/spork-strategy.md
+# in the blumeops repo for the full strategy.
+#
+# On conflict: the workflow fails. Manual rebase resolution required.
+
+name: Mirror Sync
+
+on:
+  schedule:
+    - cron: '0 5 * * *'  # Daily at 05:00 UTC
+  workflow_dispatch:
+
+jobs:
+  sync:
+    runs-on: k8s
+    steps:
+      - name: Checkout blumeops branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: blumeops
+          fetch-depth: 0
+
+      - name: Configure git
+        run: |
+          git config user.name "Forgejo Actions"
+          git config user.email "actions@forge.eblu.me"
+
+      - name: Add mirror remote
+        run: |
+          git remote add mirror "${{ env.MIRROR_URL }}" || true
+          git fetch mirror
+        env:
+          MIRROR_URL: https://forge.eblu.me/mirrors/kingfisher.git
+
+      - name: Fast-forward main from mirror
+        run: |
+          git checkout main
+          git merge --ff-only mirror/main
+          git push origin main
+
+      - name: Rebase blumeops onto main
+        run: |
+          git checkout blumeops
+          git rebase main
+          git push --force-with-lease origin blumeops
+
+      - name: Rebase feature branches
+        run: |
+          # Rebase feature/local/* onto blumeops
+          for branch in $(git branch -r --list 'origin/feature/local/*'); do
+            local_name="${branch#origin/}"
+            echo "Rebasing $local_name onto blumeops..."
+            git checkout -B "$local_name" "$branch"
+            git rebase blumeops || {
+              echo "::error::Rebase conflict on $local_name"
+              git rebase --abort
+              continue
+            }
+            git push --force-with-lease origin "$local_name"
+          done
+
+          # Rebase feature/upstream/* onto main
+          for branch in $(git branch -r --list 'origin/feature/upstream/*'); do
+            local_name="${branch#origin/}"
+            echo "Rebasing $local_name onto main..."
+            git checkout -B "$local_name" "$branch"
+            git rebase main || {
+              echo "::error::Rebase conflict on $local_name"
+              git rebase --abort
+              continue
+            }
+            git push --force-with-lease origin "$local_name"
+          done
+
+      - name: Build deploy branch
+        run: |
+          git checkout -B deploy blumeops
+
+          # Merge all feature branches into deploy
+          for branch in $(git branch -r --list 'origin/feature/local/*' 'origin/feature/upstream/*'); do
+            local_name="${branch#origin/}"
+            echo "Merging $local_name into deploy..."
+            git merge --no-ff "$local_name" -m "deploy: merge $local_name" || {
+              echo "::error::Merge conflict on $local_name into deploy"
+              git merge --abort
+              continue
+            }
+          done
+
+          git push --force-with-lease origin deploy