diff --git a/flake.nix b/flake.nix
index b31dcbf..904b08d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,15 +23,29 @@
     in
     {
       formatter.${system} = pkgs.nixfmt-tree;
-      apps.nixos-diff = {
-        type = "app";
-        program = "${pkgs.writeShellScript "nixos-diff.sh" ''
-          ${pkgs.git}/bin/git checkout flake.lock
-          ${pkgs.git}/bin/git pull --ff-only
-          ${pkgs.nix}/bin/nix flake update
-          ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
-          ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
-        ''}";
+      apps = {
+        nixos-diff = {
+          type = "app";
+          program = "${pkgs.writeShellScript "nixos-diff.sh" ''
+            ${pkgs.git}/bin/git checkout flake.lock
+            ${pkgs.git}/bin/git pull --ff-only
+            ${pkgs.nix}/bin/nix flake update
+            ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
+            ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
+          ''}";
+        };
+        deploy = {
+          type = "app";
+          program = "${pkgs.writeShellScript "deploy.sh" ''
+            set -e
+            host="''${1:?usage: nix run .#apps.deploy -- <host>}"
+            ${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
+            set -e
+            cd /etc/nixos
+            nix run .#apps.nixos-diff && nixos-rebuild switch
+            EOF
+          ''}";
+        };
       };
       devShells.${system}.default = pkgs.mkShell {
         packages = [
@@ -256,6 +270,12 @@
                 group = "forgejo";
                 mode = "0440";
               };
+              forgejo-oauth2-jwt-secret = {
+                file = ./secrets/forgejo-oauth2-jwt-secret.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
+              };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
                 owner = "root";
diff --git a/hosts/git/default.nix b/hosts/git/default.nix
index 5ccac8b..3d01d5c 100644
--- a/hosts/git/default.nix
+++ b/hosts/git/default.nix
@@ -40,5 +40,5 @@
   '';
   services.openssh.settings.Banner = "/etc/ssh/banner";
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
 }
diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index 523f3d8..60af999 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -23,10 +23,9 @@ in
           SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
           INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
         };
-        oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
+        oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
       };
       settings = {
-        security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
         session.COOKIE_SECURE = true;
         log.LEVEL = "Warn";
         server = {
@@ -78,12 +77,6 @@ in
       };
     };
 
-    openssh.extraConfig = ''
-      Match User forgejo
-        AcceptEnv GIT_PROTOCOL
-        PerSourcePenalties no
-    '';
-
     nginx.virtualHosts."${fqdn}" = {
       quic = true;
       kTLS = true;
diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index c84f18c..f8afa8e 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -78,7 +78,7 @@ in
           '';
         };
         "/all.ics" = {
-          return = "301 https://www.berlin.ccc.de/calendars/all.ics";
+          return = "301 https://$host/calendars/all.ics";
         };
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";
@@ -97,11 +97,26 @@ in
       kTLS = true;
       forceSSL = true;
       enableACME = true;
-      locations."/" = {
-        basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
-        root = "/srv/http/www-staging";
-        index = "index.html";
-        tryFiles = "$uri $uri/ $uri.html =404";
+      locations = {
+        "/" = {
+          basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
+          root = "/srv/http/www-staging";
+          index = "index.html";
+          tryFiles = "$uri $uri/ $uri.html =404";
+        };
+        "/all.ics" = {
+          return = "301 https://$host/calendars/all.ics";
+        };
+        "~ ^/calendars/([^/]+\.ics)$" = {
+          alias = "/srv/http/calendars/$1";
+          extraConfig = ''
+            add_header Cache-Control "no-cache";
+            types {
+              text/calendar ics;
+            }
+            default_type text/calendar;
+          '';
+        };
       };
     };
   };