diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
new file mode 100644
index 00000000..5e394c8a
--- /dev/null
+++ b/.forgejo/workflows/build.yml
@@ -0,0 +1,58 @@
+name: Build Aurora
+
+# Builds Aurora from this tree (`just build`, the same command upstream's
+# GitHub workflows run) and pushes it to this forge's registry as
+# forge.quinefoundation.com/quine-global-labs/aurora: `stable`, plus
+# `stable-<date>` and the commit. quine-global-labs/quine-linux builds FROM it.
+#
+# This directory existing is also what keeps Forgejo from running upstream's
+# .github/workflows, which it falls back to when there's no .forgejo/workflows.
+#
+# Runs on runner-x86-linux (host mode, root podman; petersweb-infra,
+# hosts/runner-x86-linux), which has just, buildah, skopeo, cosign, yq and jq.
+#
+# Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
+# Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: aurora-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: forge.quinefoundation.com
+  IMAGE: forge.quinefoundation.com/quine-global-labs/aurora
+  TAG: stable
+
+jobs:
+  build:
+    runs-on: runner-x86-linux
+    timeout-minutes: 300
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        # Aurora reads its own past tags from ghcr.io/$GITHUB_REPOSITORY_OWNER
+        # and hands $GITHUB_TOKEN to GitHub's API. On Forgejo Actions those
+        # are this org and a Forgejo token, so: ublue-os, and no token.
+        run: >-
+          env -u GITHUB_TOKEN
+          GITHUB_REPOSITORY_OWNER=ublue-os
+          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
+          just build --image aurora --tag "$TAG" --flavor main
+
+      - name: Push
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+          for t in "$TAG" "$TAG-$(date -u +%Y%m%d)" "${GITHUB_SHA::12}"; do
+            podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
+            podman push --retry 5 "$IMAGE:$t"
+          done
+          podman logout "$REGISTRY"