diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
new file mode 100644
index 0000000..db95b2f
--- /dev/null
+++ b/.forgejo/workflows/build.yaml
@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2024 Simon Bruder <simon@sbruder.de>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: nix
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Checkout LFS
+        run: |
+          # You have the choice:
+          # Either it sets the Authorization header twice (which git-lfs does not accept)
+          # or it sets it not at all.
+          # As the repository is public, the latter case is acceptable.
+          git config --unset "http.${GITHUB_SERVER_URL}/.extraHeader"
+          git lfs install --local
+          git lfs pull
+      - name: Build
+        run: nix build -L .#li7y .#li7y-oci
+      - name: Push OCI image
+        run: |
+          nix build .#li7y-oci
+          podman image load -i ./result
+          podman tag li7y git.sbruder.de/simon/li7y:latest
+          podman login --username simon --password "${{ secrets.REGISTRY_PASSWORD }}" git.sbruder.de
+          podman push git.sbruder.de/simon/li7y:latest