diff --git a/.gitea/workflows/mirror.yml b/.gitea/workflows/mirror.yml
new file mode 100644
index 00000000..23e527a4
--- /dev/null
+++ b/.gitea/workflows/mirror.yml
@@ -0,0 +1,34 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches: [master]
+    tags: ["*"]
+  workflow_dispatch:
+
+# Serialized rather than cancel-in-progress: aborting a push halfway leaves the
+# mirror behind whatever triggered the run, and nothing would retry it.
+concurrency:
+  group: ${{ github.workflow }}
+
+jobs:
+  push-to-github:
+    runs-on: ubuntu-latest
+    if: github.repository == 'coracle/flotilla'
+
+    steps:
+      - name: Push master and tags to GitHub
+        env:
+          GH_MIRROR_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }}
+        run: |
+          git clone --bare "${{ github.server_url }}/${{ github.repository }}.git" repo.git
+          cd repo.git
+
+          # Explicit refspecs rather than --mirror, which pushes everything
+          # under refs/ and would fail the whole push: gitea publishes 260-odd
+          # refs/pull/* refs, and github rejects that namespace outright
+          # ("deny updating a hidden ref"). Force so gitea always wins.
+          git push --force --prune \
+            "https://x-access-token:$GH_MIRROR_TOKEN@github.com/coracle-social/flotilla.git" \
+            'refs/heads/master:refs/heads/master' \
+            'refs/tags/*:refs/tags/*'