diff --git a/flake.nix b/flake.nix
index c03d5d2..9ecce5a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,15 +23,29 @@
     in
     {
       formatter.${system} = pkgs.nixfmt-tree;
-      apps.nixos-diff = {
-        type = "app";
-        program = "${pkgs.writeShellScript "nixos-diff.sh" ''
-          ${pkgs.git}/bin/git checkout flake.lock
-          ${pkgs.git}/bin/git pull --ff-only
-          ${pkgs.nix}/bin/nix flake update
-          ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
-          ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
-        ''}";
+      apps = {
+        nixos-diff = {
+          type = "app";
+          program = "${pkgs.writeShellScript "nixos-diff.sh" ''
+            ${pkgs.git}/bin/git checkout flake.lock
+            ${pkgs.git}/bin/git pull --ff-only
+            ${pkgs.nix}/bin/nix flake update
+            ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
+            ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
+          ''}";
+        };
+        deploy = {
+          type = "app";
+          program = "${pkgs.writeShellScript "deploy.sh" ''
+            set -e
+            host="''${1:?usage: nix run .#apps.deploy -- <host>}"
+            ${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
+            set -e
+            cd /etc/nixos
+            nix run .#apps.nixos-diff && nixos-rebuild switch
+            EOF
+          ''}";
+        };
       };
       devShells.${system}.default = pkgs.mkShell {
         packages = [
@@ -256,6 +270,12 @@
                 group = "forgejo";
                 mode = "0440";
               };
+              forgejo-oauth2-jwt-token = {
+                file = ./secrets/forgejo-oauth2-jwt-token.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
+              };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
                 owner = "root";