diff --git a/.build.yml b/.build.yml
new file mode 100644
index 0000000000000000000000000000000000000000..35fd8e3488d47211e4706e0041c1063b47ceed18
--- /dev/null
+++ b/.build.yml
@@ -0,0 +1,65 @@
+image: alpine/edge
+packages:
+  - abuild
+  - go
+  - git
+  - rclone
+secrets:
+  # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing
+  # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket.
+  - apk-ci-s3
+sources:
+  - https://git.srht.bigb.es/~bigbes/sr-ht-compare
+environment:
+  REPO: sr-ht-compare
+  APK_REPO: alpine/v3.22/bigbes/x86_64
+  S3_BUCKET: repo
+  S3_ENDPOINT: https://s3.bigb.es
+submitter:
+  git.sr.ht:
+    allow-refs:
+      - refs/heads/master
+tasks:
+  - keygen: |
+      # abuild insists on signing what it builds, but this key is deliberately
+      # throwaway: generated per build, dies with the VM, trusted by nothing.
+      # Clients verify against the index instead, which is rebuilt and signed on
+      # phoebe by the garage stack's apk-mirror service — it indexes this repo
+      # with --allow-untrusted precisely because of this.
+      #
+      # -i installs the public half into /etc/apk/keys. Without it abuild's own
+      # final "update the local repository index" step dies with UNTRUSTED
+      # signature, after having built the package perfectly well.
+      SUDO=sudo abuild-keygen -a -n -i -q
+  - version: |
+      cd "$REPO"
+      ver="0.0.$(git rev-list --count HEAD)"
+      sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
+      echo "export PKGVER=$ver" >> ~/.buildenv
+      echo "building $ver"
+  - build: |
+      cd "$REPO"
+      # -d: makedepends are already installed via `packages:` above, so skip
+      # abuild's own dependency resolution (which would want to sudo apk add).
+      REPODEST=$HOME/packages abuild -d
+      find "$HOME/packages" -name '*.apk'
+  - publish: |
+      set +x   # never echo the S3 credentials into the build log
+      . ~/.apk-ci.env
+      export RCLONE_CONFIG_GARAGE_TYPE=s3
+      export RCLONE_CONFIG_GARAGE_PROVIDER=Other
+      export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT"
+      export RCLONE_CONFIG_GARAGE_REGION=garage
+      export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true
+      export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY"
+      export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY"
+      set -x
+      # Upload only; never delete. Old versions stay so a pinned deployment can
+      # always be rebuilt — the same reason the upstream mirror is append-only.
+      # abuild nests output under $REPODEST/<repo>/<arch>/, so flatten by
+      # uploading each file to a fixed prefix rather than mirroring the tree.
+      find "$HOME/packages" -name '*.apk' -print | while read -r f; do
+        rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")"
+        echo "uploaded $(basename "$f")"
+      done
+      echo "published; apk-mirror on phoebe re-indexes within 15 minutes"
diff --git a/.sourcecraft/webhooks.yaml b/.sourcecraft/webhooks.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..e7fca1b842b72199ae850ac0ae668ae722f4ea6f
--- /dev/null
+++ b/.sourcecraft/webhooks.yaml
@@ -0,0 +1,24 @@
+# Notifies the lab's gitsync service that this repo has moved, so the mirror on
+# our self-hosted sourcehut updates within seconds instead of waiting for its
+# hourly safety-net poll. That matters beyond the mirror itself: builds.sr.ht CI
+# (see .build.yml) only fires once the commit lands on the sourcehut side, so
+# this webhook is what makes push -> apk build feel immediate.
+#
+# The receiver verifies the HMAC-SHA256 in X-Src-Signature over the request
+# body. The signing key is generated by SourceCraft, is not part of this file,
+# and is read once from Автоматизации -> Вебхуки into the gitsync stack's .env.
+#
+# The slug is unique per repository, but the receiver serves all three repos and
+# maps slug -> signing key, so it must be unique ACROSS them too — hence the
+# suffix rather than a plain "gitsync".
+webhooks:
+  hooks:
+    - slug: gitsync-compare
+      name: "gitsync mirror trigger"
+      description: "Triggers the phoebe gitsync service to mirror sr-ht-compare to git.srht.bigb.es"
+      url: "https://gitsync.bigb.es/hook"
+      ssl_verification: true
+      active: true
+  on:
+    push:
+      - hooks: ["gitsync-compare"]
diff --git a/APKBUILD b/APKBUILD
new file mode 100644
index 0000000000000000000000000000000000000000..80de5cd87bffb6de40b25cea1a931211d8a650f2
--- /dev/null
+++ b/APKBUILD
@@ -0,0 +1,39 @@
+# Maintainer: bigbes <bigbes@gmail.com>
+#
+# Built by builds.sr.ht (.build.yml) and published to our own apk repo at
+# repo.bigb.es/alpine/v3.22/bigbes. The srht deployment installs it from there
+# instead of cloning and compiling this repo inside its Dockerfile.
+#
+# pkgver is rewritten by CI to 0.0.<commit count> before abuild runs — a
+# monotonic, unique-per-commit version that the deployment can pin. The literal
+# below is only what a local `abuild` would use.
+pkgname=compare.sr.ht
+pkgver=0.0.0
+pkgrel=0
+pkgdesc="Stateless diff/compare viewer for a sourcehut instance"
+url="https://sourcecraft.dev/bigbes/sr-ht-compare"
+arch="x86_64"
+license="MIT"
+# !check      — the Go tests need a live git.sr.ht API, not available in the VM
+# !tracedeps  — CGO_ENABLED=0, so there are no shared-object deps to trace
+options="!check !tracedeps"
+
+# No source= : CI builds the checkout it was handed, so abuild works in place
+# rather than fetching a tarball. builddir points at the repo root, which is the
+# directory holding this APKBUILD.
+source=""
+builddir="$startdir"
+
+build() {
+	cd "$builddir"
+	# web/static (bundle.js + hashed CSS) is committed and go:embed-ed, so
+	# there is no `make css` / `make bundle` step here — see README.
+	CGO_ENABLED=0 make build GOFLAGS="-trimpath"
+}
+
+package() {
+	cd "$builddir"
+	# The Makefile honours DESTDIR; ASSETS must stay the real runtime path so
+	# the binary's static-dir glob resolves after install.
+	make install DESTDIR="$pkgdir" PREFIX=/usr ASSETS=/usr/share/sourcehut
+}