diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
new file mode 100644
index 000000000..43da98a45
--- /dev/null
+++ b/.github/workflows/mirror.yml
@@ -0,0 +1,44 @@
+name: "mirror base source"
+
+on:
+  release:
+    types: [released]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Mirror base source
+    concurrency:
+      group: mirror-${{ github.ref }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch release source
+        run: |
+          set -eu
+
+          MP_VERS="$(echo "$GITHUB_REF_NAME" | colrm 1 1)"
+          SOURCE_FILE="MacPorts-${MP_VERS}.tar.bz2"
+          SIG_FILE="${SOURCE_FILE}.sig"
+          DOWNLOAD_BASEURL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/"
+          mkdir -p mpsource
+          curl -fL -o "./mpsource/${SOURCE_FILE}" "${DOWNLOAD_BASEURL}${SOURCE_FILE}"
+          curl -fL -o "./mpsource/${SIG_FILE}" "${DOWNLOAD_BASEURL}${SIG_FILE}"
+
+      - name: Deploy release source
+        env:
+          MIRROR_SSH_HOST: ${{ secrets.MIRROR_SSH_HOST }}
+          MIRROR_SSH_HOSTKEY: ${{ secrets.MIRROR_SSH_HOSTKEY }}
+          MIRROR_SSH_KEY: ${{ secrets.MIRROR_SSH_KEY }}
+          MIRROR_SSH_USER: ${{ secrets.MIRROR_SSH_USER }}
+        run: |
+          set -eu
+
+          echo "Uploading tarball for MacPorts $GITHUB_REF_NAME"
+          echo "$MIRROR_SSH_KEY" > ssh_key
+          chmod 0600 ssh_key
+          echo "$MIRROR_SSH_HOSTKEY" > ssh_known_hosts
+          export RSYNC_RSH="ssh -l $MIRROR_SSH_USER -i ssh_key -oUserKnownHostsFile=ssh_known_hosts -p 23"
+          rsync -av --progress ./mpsource/MacPorts-* "${MIRROR_SSH_HOST}:"