diff --git a/.forgejo/workflows/miau.yaml b/.forgejo/workflows/miau.yaml
new file mode 100644
index 0000000..1813837
--- /dev/null
+++ b/.forgejo/workflows/miau.yaml
@@ -0,0 +1,58 @@
+name: deploy blog
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 10 * * *'  # daily at 10:00
+  push:
+    branches:
+      - staging
+      - production
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install dependencies
+        run: apk --no-cache add hugo python3 py3-pip git openssh-client rsync
+
+      - name: Check versions
+        run: |
+          cat /etc/os-release
+          git version
+          hugo version
+          python --version
+          rsync --version
+          ssh -V
+
+      - name: Set envionment vars
+        run: echo "GIT_BRANCH=${{ forgejo.event_name == 'schedule' && 'production' || forgejo.ref_name }}" >> "$FORGEJO_ENV"
+
+      - name: Checkout repository
+        run: |
+          git clone -b $GIT_BRANCH --recursive https://git.berlin.ccc.de/cccb-website-team/www.git .
+          git status
+
+      - name: Install Python dependencies
+        run: python -m pip install -r requirements.txt --break-system-packages
+
+      - name: Render site
+        run: ./build.sh
+
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          printf "%s" "${{ secrets.KNOWN_HOSTS }}" | base64 -d > ~/.ssh/known_hosts
+          printf "%s" "${{ env.GIT_BRANCH == 'production' && secrets.SSH_PRIVATE_KEY_PRODUCTION || secrets.SSH_PRIVATE_KEY_STAGING }}" | base64 -d > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keygen -f ~/.ssh/id_ed25519 -y > ~/.ssh/id_ed25519.pub
+          cat ~/.ssh/id_ed25519.pub
+
+      - name: Rsync rendered site
+        # TODO: add --delete
+        run: rsync -var -e 'ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=yes' ./public/ deploy@www.berlin.ccc.de:${{ env.GIT_BRANCH == 'production' && '/srv/http/www/' || '/srv/http/www-staging/' }}
+
+      - name: Cleanup
+        if: ${{ always() }}
+        run: rm -rf ~/.ssh
+