diff --git a/devtools/gerrit/hooks/ref-updated b/devtools/gerrit/hooks/ref-updated
new file mode 100755
index 0000000..943aec8
--- /dev/null
+++ b/devtools/gerrit/hooks/ref-updated
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -e
+
+# This will be ran by Gerrit any time a new Git commit is pushed, and will make
+# Forgejo pull our changes.
+
+if [ -z "$FORGEJO_TOKEN" ]; then
+    echo "FORGEJO_TOKEN must be set" > /dev/stderr
+    exit 1
+fi
+
+# The gerrit image has no curl. But where we're going, we don't need curl.
+auth="$(echo -ne "gerrit:$FORGEJO_TOKEN" | base64)"
+openssl s_client -quiet -crlf -connect git.hackerspace.pl:443 <<EOF
+POST /api/v1/repos/hswaw/hscloud/mirror-sync HTTP/1.1
+Host: git.hackerspace.pl
+Authorization: Basic $auth
+Content-length: 0
+Connection: Close
+
+EOF