diff --git a/scripts/forge-create-user.sh b/scripts/forge-create-user.sh
new file mode 100755
index 0000000..827f6fa
--- /dev/null
+++ b/scripts/forge-create-user.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Create a Forgejo user in the hive-forge container.
+#
+# Usage: forge-create-user.sh <username> [--admin] [--email <addr>] [--password <pw>]
+#
+# Defaults: --random-password, --must-change-password=false, email = <user>@hive.local.
+# Requires: sudo, the hive-forge nixos-container running.
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: $0 <username> [--admin] [--email <addr>] [--password <pw>]" >&2
+  exit 2
+fi
+
+username="$1"; shift
+email="${username}@hive.local"
+admin=()
+password_args=(--random-password)
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --admin)    admin=(--admin); shift ;;
+    --email)    email="$2"; shift 2 ;;
+    --password) password_args=(--password "$2"); shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+sudo nixos-container run hive-forge -- runuser -u forgejo -- \
+  forgejo --work-path /var/lib/forgejo admin user create \
+    --username "$username" \
+    --email "$email" \
+    --must-change-password=false \
+    "${password_args[@]}" \
+    "${admin[@]}"