diff --git a/.gitea/workflows/ipcr.yml b/.gitea/workflows/ipcr.yml
new file mode 100644
index 0000000..e1bce40
--- /dev/null
+++ b/.gitea/workflows/ipcr.yml
@@ -0,0 +1,42 @@
+# IPCR Forge: builds the forge service's image (forge/Dockerfile) for every v* tag pushed to this repository's Gitea copy, and pushes it
+# to the forge's staging registry; IPCR imports it from there within a minute and publishes it on
+# IPFS under the forge's name (<forge>/ipcr/ipcr-forge, and ipcr-forge at the root).
+#
+# GitHub ignores .gitea/ (it runs .github/workflows/image.yml → ghcr.io), and Gitea ignores
+# .github/ as soon as this folder exists: one repository, one workflow on each side.
+#
+#   runs-on: ipcr              the forge's own runner, the only one that reaches the staging registry
+#   localhost:5000             that registry, logged in to as this repository (IPCR_PUSH_TOKEN, a
+#                              secret the forge sets on every repository allowed to publish)
+#   network=host               so buildx's builder can reach it too
+name: ipcr
+on:
+  push:
+    tags: ['v*']
+jobs:
+  image:
+    runs-on: ipcr
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: localhost:5000
+          username: ${{ github.repository }}
+          password: ${{ secrets.IPCR_PUSH_TOKEN }}
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: localhost:5000/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: network=host
+      - uses: docker/build-push-action@v6
+        with:
+          context: forge
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}