diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
new file mode 100644
index 0000000000..d2988909f9
--- /dev/null
+++ b/.forgejo/workflows/ci.yaml
@@ -0,0 +1,61 @@
+on: [push]
+jobs:
+  generate-targets:
+    runs-on: cacher
+    outputs:
+      targets: ${{ steps.build.outputs.targets }}
+      machines: ${{ steps.build.outputs.machines }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Drop in ops/secrets/default.nix
+        run:
+          echo "$OPS_SECRETS_DEFAULTNIX" > ops/secrets/default.nix
+        env:
+          OPS_SECRETS_DEFAULTNIX: "${{ secrets.OPS_SECRETS_DEFAULTNIX }}"
+
+      - id: build
+        name: Build matrix
+        run: |
+          cat "$(nix-build ci-root.nix -A forgejoMatrix)" >> "$GITHUB_OUTPUT"
+
+  build:
+    runs-on: cacher
+    needs: [generate-targets]
+    strategy:
+      matrix:
+        target: ${{ fromJSON(needs.generate-targets.outputs.targets) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Drop in ops/secrets/default.nix
+        run: |
+          echo "$OPS_SECRETS_DEFAULTNIX" > ops/secrets/default.nix
+        env:
+          OPS_SECRETS_DEFAULTNIX: "${{ secrets.OPS_SECRETS_DEFAULTNIX }}"
+
+      - name: Build
+        run: |
+          nix-build ci-root.nix -A "${{ matrix.target }}"
+
+  build-machine:
+    runs-on: cacher
+    needs: [generate-targets]
+    strategy:
+      matrix:
+        target: ${{ fromJSON(needs.generate-targets.outputs.machines) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Drop in ops/secrets/default.nix
+        run: |
+          echo "$OPS_SECRETS_DEFAULTNIX" > ops/secrets/default.nix
+        env:
+          OPS_SECRETS_DEFAULTNIX: "${{ secrets.OPS_SECRETS_DEFAULTNIX }}"
+
+      - name: Build
+        run: |
+          nix-build ci-root.nix -A "machine.${{ matrix.target }}"
diff --git a/ci-root.nix b/ci-root.nix
index 90252ff842..fe2c76738b 100644
--- a/ci-root.nix
+++ b/ci-root.nix
@@ -56,5 +56,30 @@ let
     notADerivationOrPath = builtins.filter (elem: !lib.isString elem.path && !lib.isDerivation elem.path) entries;
     notADerivationOrPath' = map (elem: elem.name) notADerivationOrPath;
   in assert lib.assertMsg ((lib.length notADerivationOrPath') == 0) "not a derivation or path: ${toString notADerivationOrPath'}"; entries;
+  
+  entries = entriesFilter (builtins.concatLists (lib.mapAttrsToList prefixAttrs ciBits));
+  linkFarm = pkgs.linkFarm "ci" entries;
+
+  targetNamer' = prefix: lib.mapAttrsToList (name: value: let
+      prefixedName = prefix ++ [name];
+      finalName = lib.concatStringsSep "." prefixedName;
+    in
+      if lib.isDerivation value then finalName
+      else if lib.isAttrs value then targetNamer' prefixedName value
+      else finalName
+  );
+  targetNamer = attrs: lib.flatten (targetNamer' [] attrs);
+
+  delimiter = "HONKHONKHONKxxxHONKHONKHONK";
+  forgejoMatrix = pkgs.writeText "forgejo-ci-matrix" ''
+    machines<<${delimiter}
+    ${builtins.toJSON (builtins.attrNames depot.ops.nixos.systems)}
+    ${delimiter}
+    targets<<${delimiter}
+    ${builtins.toJSON (lib.filter (name: !lib.hasPrefix "machine." name) (targetNamer ciBits))}
+    ${delimiter}
+  '';
 in
-pkgs.linkFarm "ci" (entriesFilter (builtins.concatLists (lib.mapAttrsToList prefixAttrs ciBits)))
+ciBits // {
+  inherit forgejoMatrix linkFarm;
+}