diff --git a/.forgejo/workflows/generate-webrtc.yml b/.forgejo/workflows/generate-webrtc.yml
new file mode 100644
index 000000000000..8c7733a17159
--- /dev/null
+++ b/.forgejo/workflows/generate-webrtc.yml
@@ -0,0 +1,89 @@
+on:
+  workflow_dispatch:
+    inputs:
+      signalver:
+        description: 'signal tag or commit'
+        required: false
+        type: string
+      webrtcver:
+        description: 'webrtc version'
+        required: false
+        type: string
+
+  push:
+    tags:
+      - 'v7*'
+    tags-ignore:
+      - '*-beta*'
+
+jobs:
+  build-tarball:
+    name: Build tarball
+    runs-on: x86_64
+    container:
+      image: alpine:3.19
+    env:
+      VPYTHON_BYPASS: manually managed python not supported by chrome operations
+      ZSTD_LIMIT: 0
+      DEPOT_TOOLS_VER: ae3745656b1111c995e41ec70eaa4397eaea7951
+    steps:
+      - name: Environment setup
+        run: apk add nodejs git zstd tar sed bash py3-httplib2 wget curl
+      - name: Getting depot_tools
+        run: |
+          git clone --depth 1 https://chromium.googlesource.com/chromium/tools/depot_tools.git ./
+          git fetch --depth 1 origin $DEPOT_TOOLS_VER
+          git checkout $DEPOT_TOOLS_VER
+      - name: Getting variables
+        run: |
+          if test $GITHUB_REF_NAME == "ci" ; then
+            _signalver=${{ inputs.signalver }} 
+            _webrtcver=${{ inputs.webrtcver }} 
+          else
+            _signalver=$GITHUB_REF_NAME
+          fi
+          if [ -n "$_webrtcver" ]; then
+            echo "webrtcver set manually with $_webrtcver"
+            echo $_webrtcver > webrtcver
+          elif [ -z "$_signalver" ]; then
+            echo "When Signal commit is unset, webrtc commit needs be set"
+            return 1
+          else
+            echo "Fetching webrtcver for Signal version $_signalver"
+            curl --silent https://raw.githubusercontent.com/signalapp/Signal-Desktop/$_signalver/package-lock.json | grep "@signalapp/ringrtc\": \"" | awk '{print $2}' | tr -d ',' | tr -d '"' | head -n 1 > ringrtcver
+            read _ringrtcver < ringrtcver
+            curl --silent https://raw.githubusercontent.com/signalapp/ringrtc/v$_ringrtcver/config/version.properties | awk -F '=' '{if($1 == "webrtc.version"){print $2}}' | head -n 1 > webrtcver
+          fi
+      - name: Fetching webrtc
+        run: |
+          read  _webrtcver < webrtcver
+          echo "Fetching webrtc $_webrtcver"
+          echo "solutions = [{'name': 'src','url': 'https://github.com/signalapp/webrtc.git@$_webrtcver',}]" > .gclient
+          echo "target_cpu = ['x64', 'arm64']" >> .gclient
+          echo "target_cpu_only = True" >> .gclient
+          ./gclient sync --no-history --nohooks
+      - name: Preparing source
+        run: |
+          read _webrtcver < webrtcver
+          python3 'src/build/landmines.py' --landmine-scripts 'src/tools_webrtc/get_landmines.py' --src-dir 'src'
+          python3 'src/build/util/lastchange.py' -o 'src/build/util/LASTCHANGE'
+          scanelf -RA -F "%F" src > elf.list
+          while read file; do rm -f "$file"; done < elf.list
+          mv src webrtc-$_webrtcver
+      - name: Packaging source
+        run: |
+          read _webrtcver < webrtcver
+          tar -cf webrtc-$_webrtcver.tar --exclude="ChangeLog*" --exclude="testdata/" --exclude="test_data/" --exclude="android_rust_toolchain/toolchain/" --exclude="base/" --exclude=third_party/instrumented_libs/binaries --exclude-backups --exclude-caches-all --exclude-vcs webrtc-$_webrtcver
+          zstd --auto-threads=logical --ultra --long -22 -T"$ZSTD_LIMIT" -vv webrtc-$_webrtcver.tar -o webrtc-$_webrtcver.tar.zst
+      - name: Computing checksums
+        run: |
+          read _webrtcver < webrtcver
+          sha512sum webrtc-$_webrtcver.tar.zst > webrtc-$_webrtcver.tar.zst.sha512sum
+          sha256sum webrtc-$_webrtcver.tar.zst > webrtc-$_webrtcver.tar.zst.sha256sum
+      - name: Package deployment 
+        run: |
+          read _webrtcver < webrtcver
+          echo "Sending to ${{ github.server_url }}/api/packages/mirrors/generic/webrtc/$_webrtcver/webrtc-$_webrtcver.tar.zst"
+          curl --user ${{ vars.CODE_FORGEJO_USER }}:${{ secrets.CODE_FORGEJO_TOKEN }} --upload-file webrtc-*.tar.zst ${{ github.server_url }}/api/packages/mirrors/generic/webrtc/$_webrtcver/webrtc-$_webrtcver.tar.zst
+          curl --user ${{ vars.CODE_FORGEJO_USER }}:${{ secrets.CODE_FORGEJO_TOKEN }} --upload-file webrtc-*.tar.zst.sha512sum ${{ github.server_url }}/api/packages/mirrors/generic/webrtc/$_webrtcver/webrtc-$_webrtcver.tar.zst.sha512sum
+          curl --user ${{ vars.CODE_FORGEJO_USER }}:${{ secrets.CODE_FORGEJO_TOKEN }} --upload-file webrtc-*.tar.zst.sha256sum ${{ github.server_url }}/api/packages/mirrors/generic/webrtc/$_webrtcver/webrtc-$_webrtcver.tar.zst.sha256sum
diff --git a/.forgejo/workflows/mirror-repository.yml b/.forgejo/workflows/mirror-repository.yml
new file mode 100644
index 000000000000..f494d5a3e4bc
--- /dev/null
+++ b/.forgejo/workflows/mirror-repository.yml
@@ -0,0 +1,52 @@
+on:
+  workflow_dispatch:
+
+  schedule:
+    - cron: '@hourly'
+
+jobs:
+  mirror:
+    name: Pull from upstream
+    runs-on: x86_64
+    container:
+      image: alpine:latest
+    env:
+      upstream: https://github.com/signalapp/Signal-Desktop
+      tags: 'v7*'
+    steps:
+      - name: Environment setup
+        run: apk add grep git sed coreutils bash nodejs
+      - name: Fetch destination
+        uses: actions/checkout@v4
+        with:
+          fetch_depth: 1
+          ref: ci
+          token: ${{ secrets.CODE_FORGEJO_TOKEN }}
+      - name: Missing tag detecting
+        run: |
+          git ls-remote $upstream "refs/tags/$tags" | grep -v '{' | sed 's|.*/||' > upstream_tags
+          git ls-remote ${{ github.server_url}}/${{ github.repository }} "refs/tags/$tags" | grep -v '{' | sed 's|.*/||' > destination_tags
+          cat upstream_tags destination_tags | tr ' ' '\n' | sort | uniq -u > missing_tags
+          echo "Missing tags:"
+          cat missing_tags
+      - name: Missing tag fetch
+        run: |
+          git remote add upstream $upstream
+          while read tag; do
+            git fetch upstream tag $tag --no-tags
+          done < missing_tags
+      - name: Packaging workflow injection
+        run: |
+          while read tag; do
+            git checkout $tag
+            git tag -d $tag
+            git checkout ci -- ./.forgejo
+            git config user.name "forgejo-actions[bot]"
+            git config user.email "dev@ayakael.net"
+            git commit -m 'Inject custom workflow'
+            git tag -a $tag -m $tag
+          done < missing_tags
+      - name: Push to destination
+        run: | # use http 1.1 due to http 2 stream not closing cleanly
+          git config --global http.version HTTP/1.1
+          git push --force origin refs/tags/*:refs/tags/* --tags