diff --git a/APKBUILD b/APKBUILD
index 8800cf53cf367c976d90c71f8fe33019ab16d8e4..9cd0aa7a182900f274ff7318651805106f78675a 100644
--- a/APKBUILD
+++ b/APKBUILD
@@ -17,6 +17,10 @@ # !check      — tests want a live Postgres and a chunk store
 # !tracedeps  — CGO_ENABLED=0 with -tags gms_pure_go, so the binaries are
 #               static: no ICU, no gozstd, nothing to trace
 options="!check !tracedeps"
+# The hook subpackage carries dolt-git-hook alone: it is installed into the
+# git.sr.ht container (as its post-update-script), not the dolt one, and
+# pulling the full service package in there would drag doltsrht along.
+subpackages="$pkgname-hook:hook"
 
 source=""
 builddir="$startdir"
@@ -58,3 +62,8 @@ 	# $(BINDIR)/$(SHAREDIR) directly), so the staging dir is passed as PREFIX.
 	# MIGRATIONDIR and STATICDIR are both derived from SHAREDIR, so they follow.
 	make install PREFIX="$pkgdir/usr"
 }
+
+hook() {
+	pkgdesc="post-update hook that provisions companion Dolt databases (for the git.sr.ht container)"
+	amove usr/bin/dolt-git-hook
+}
diff --git a/Makefile b/Makefile
index a1512ca66724dca62a2c7b418b17dd2eb465109f..a6550b88c48771140db339479f2a33fd685287f3 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,8 @@ GOBUILD=$(GO) build $(if $(GO_TAGS),-tags "$(GO_TAGS)",)
 
 BINARIES=\
 	doltsrht \
-	doltsrht-migrate
+	doltsrht-migrate \
+	dolt-git-hook
 
 # Default target builds the Go binaries only. CSS (all-share) is deliberately
 # kept off the default path because sassc/minify are not always installed on
@@ -56,6 +57,14 @@ 		echo "$(GOBUILD) -o $@ ./cmd/doltsrht-migrate"; \
 		$(GOBUILD) -o $@ ./cmd/doltsrht-migrate; \
 	else \
 		echo "skip $@: ./cmd/doltsrht-migrate not present yet"; \
+	fi
+
+dolt-git-hook:
+	@if [ -d ./cmd/dolt-git-hook ]; then \
+		echo "$(GOBUILD) -o $@ ./cmd/dolt-git-hook"; \
+		$(GOBUILD) -o $@ ./cmd/dolt-git-hook; \
+	else \
+		echo "skip $@: ./cmd/dolt-git-hook not present yet"; \
 	fi
 
 # Compile every buildable package; used as the CI build gate.