diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 16684c4f..ca06202d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -130,3 +130,16 @@ jobs:
             || contains(needs.*.result, 'cancelled')
             || contains(needs.*.result, 'skipped') }}
         run: exit 1
+
+  deploy:
+    name: deploy
+    needs: all-builds
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Fast-forward deploy ref
+        run: git push origin HEAD:deploy
diff --git a/CLAUDE.md b/CLAUDE.md
index 020a74b6..3ab499b3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -116,8 +116,7 @@ the insecure package, the assertion fails and prompts removal.
 are port-forwarded to tower (`.10`).
 
 **LAN DHCP + DNS:** served by `pi` via `dnsmasq` (`modules/lan-dns.nix`,
-listening on `end0`, static `.18`). Pi auto-upgrades from main nightly — test
-before merging.
+listening on `end0`, static `.18`).
 
 **Static LAN addresses:** `pi end0` `.18` (MAC `DC:A6:32:13:51:14`), `tower`
 `.10` (motherboard NIC `enp11s0`, static via NetworkManager in
diff --git a/flake.nix b/flake.nix
index bfb1b304..c41dbc55 100644
--- a/flake.nix
+++ b/flake.nix
@@ -93,6 +93,7 @@
           ./modules/file-manager.nix
           ./modules/pimsync.nix
           ./modules/lan-dns.nix
+          ./modules/auto-upgrade.nix
           ./modules/darkman.nix
           ./modules/mpd.nix
           ./modules/hypridle.nix
diff --git a/modules/auto-upgrade.nix b/modules/auto-upgrade.nix
new file mode 100644
index 00000000..960ac486
--- /dev/null
+++ b/modules/auto-upgrade.nix
@@ -0,0 +1,65 @@
+_: {
+  flake.nixosModules.autoUpgrade =
+    { pkgs, lib, ... }:
+    let
+      deployGate = pkgs.writeShellApplication {
+        name = "pi-deploy-gate";
+
+        runtimeInputs = [
+          pkgs.gitMinimal
+          pkgs.coreutils
+        ];
+
+        inheritPath = false;
+
+        text = ''
+          state_dir=/var/lib/nixos-upgrade
+          last_rev="$state_dir/last-deployed-rev"
+          pending_rev="$state_dir/pending-rev"
+          deploy_url=https://github.com/etrobert/setup.git
+
+          case "$1" in
+            check)
+              rev=$(git ls-remote "$deploy_url" deploy | cut --fields=1)
+              if [ -z "$rev" ]; then
+                echo "could not resolve deploy ref; skipping" >&2
+                exit 1
+              fi
+              if [ -f "$last_rev" ] && [ "$rev" = "$(cat "$last_rev")" ]; then
+                echo "deploy $rev already live; skipping"
+                exit 1
+              fi
+              printf '%s\n' "$rev" > "$pending_rev"
+              echo "deploy $rev differs from live; upgrading"
+              ;;
+            record)
+              if [ -f "$pending_rev" ]; then
+                mv "$pending_rev" "$last_rev"
+              fi
+              ;;
+            *)
+              echo "usage: pi-deploy-gate {check|record}" >&2
+              exit 2
+              ;;
+          esac
+        '';
+      };
+    in
+    {
+      system.autoUpgrade = {
+        enable = true;
+        flake = "github:etrobert/setup/deploy#pi";
+        flags = [
+          "--accept-flake-config"
+          "--print-build-logs"
+        ];
+        dates = "*:0/1"; # every minute
+      };
+
+      systemd.services.nixos-upgrade.serviceConfig = {
+        StateDirectory = "nixos-upgrade";
+        ExecCondition = "${lib.getExe deployGate} check";
+        ExecStartPost = "${lib.getExe deployGate} record";
+      };
+    };
+}
diff --git a/modules/hosts/pi/configuration.nix b/modules/hosts/pi/configuration.nix
index 03c53511..080838a4 100644
--- a/modules/hosts/pi/configuration.nix
+++ b/modules/hosts/pi/configuration.nix
@@ -27,17 +27,6 @@
     };
   };
 
-  system.autoUpgrade = {
-    enable = true;
-    flake = "github:etrobert/setup/main#pi";
-    flags = [
-      "--accept-flake-config"
-      "--print-build-logs"
-    ];
-    # dates = "4:40"; # default value
-    randomizedDelaySec = "5min";
-  };
-
   networking.hostName = "pi";
 
   networking.networkmanager = {
diff --git a/modules/hosts/pi/default.nix b/modules/hosts/pi/default.nix
index f92a6d2d..7533b830 100644
--- a/modules/hosts/pi/default.nix
+++ b/modules/hosts/pi/default.nix
@@ -12,6 +12,7 @@
       self.nixosModules.nixosBase
       self.nixosModules.base
       self.nixosModules.lanDns
+      self.nixosModules.autoUpgrade
       inputs.agenix.nixosModules.default
     ];
   };