diff --git a/.forgejo/workflows/update-dns-upstream.yaml b/.forgejo/workflows/update-dns-upstream.yaml
new file mode 100644
index 0000000..be9d15b
--- /dev/null
+++ b/.forgejo/workflows/update-dns-upstream.yaml
@@ -0,0 +1,21 @@
+name: update-dns-upstream
+on: [push]
+
+jobs:
+  execute:
+    runs-on: docker
+    container:
+      image: node:latest
+      env:
+        CLOUDFLARE_ACCOUNT_ID: ${{ secrets.cloudflare_account_id }}
+        CLOUDFLARE_API_TOKEN: ${{ secrets.cloudflare_api_token }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Update DNS upstream
+        shell: bash
+        run: |
+          nix run . -- version
+          nix run . -- push
diff --git a/flake.nix b/flake.nix
index 123de48..3644d22 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,9 +5,7 @@
 
   outputs = { self, nixpkgs, flake-utils }:
     flake-utils.lib.eachDefaultSystem (system:
-      let
-        pkgs = nixpkgs.legacyPackages.${system};
-      in {
-        packages.default = nixpkgs.legacyPackages.${system}.dnscontrol;
-      });
+    {
+      packages.default = nixpkgs.legacyPackages.${system}.dnscontrol;
+    });
 }