diff --git a/.gitea/workflows/mirror.yaml b/.gitea/workflows/mirror.yaml
new file mode 100644
index 0000000..ebcf216
--- /dev/null
+++ b/.gitea/workflows/mirror.yaml
@@ -0,0 +1,67 @@
+name: Mirror
+
+on:
+  delete:
+  push:
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: github.event_name != 'delete'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    concurrency:
+      cancel-in-progress: false
+      group: mirror
+    steps:
+      - name: Push every branch and tag to GitHub, overwriting a same-named ref
+        env:
+          MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
+          MIRROR_URL: https://github.com/larvit/smpp-js.git
+          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          git clone --bare --quiet "$SOURCE_URL" mirror.git
+          git -C mirror.git -c credential.helper= \
+            -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
+            push "$MIRROR_URL" '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
+
+  delete:
+    if: github.event_name == 'delete'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    concurrency:
+      cancel-in-progress: false
+      group: mirror
+    steps:
+      - name: Delete the ref from GitHub once Gitea no longer has it
+        env:
+          MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
+          MIRROR_URL: https://github.com/larvit/smpp-js.git
+          REF: ${{ github.event.ref }}
+          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          # Gitea Actions sends the full ref name here, where its webhooks send the short one.
+          case "$REF" in
+            refs/heads/*|refs/tags/*) ;;
+            *) echo "delete event names '$REF', not a full branch or tag ref"; exit 1 ;;
+          esac
+
+          # ls-remote --exit-code: 0 the ref exists, 2 it does not, anything else the remote could not be read.
+          on_gitea=0
+          git ls-remote --exit-code "$SOURCE_URL" "$REF" > /dev/null || on_gitea=$?
+          if [ "$on_gitea" -ne 2 ]; then exit "$on_gitea"; fi
+
+          on_github=0
+          git ls-remote --exit-code "$MIRROR_URL" "$REF" > /dev/null || on_github=$?
+          if [ "$on_github" -eq 2 ]; then exit 0; fi
+          if [ "$on_github" -ne 0 ]; then exit "$on_github"; fi
+
+          git init --bare --quiet mirror.git
+          git -C mirror.git -c credential.helper= \
+            -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
+            push "$MIRROR_URL" ":$REF"
diff --git a/todo.md b/todo.md
index 3721649..6fd6d58 100644
--- a/todo.md
+++ b/todo.md
@@ -74,8 +74,8 @@ Every defect listed in the AGENTS.md table has a regression test naming the beha
 
 ## Move the repository to Gitea
 
-`gitea.larvit.se/larvit/smpp-js` is the repository. `github.com/larvit/smpp-js` becomes a push mirror
-of it and the place issues are filed. Maintainer's calls, 2026-09-13 and 2026-09-14.
+`gitea.larvit.se/larvit/smpp-js` is the repository. `github.com/larvit/smpp-js` mirrors it and is the
+place issues are filed. Maintainer's calls, 2026-09-13 and 2026-09-14.
 
 - [x] `larvit/smpp-js` holds `main`, from `typescript`, and `v0.4.0`, from `master`. `rewrite-base`
       and the `renovate/*` branches stayed behind.
@@ -106,8 +106,8 @@ of it and the place issues are filed. Maintainer's calls, 2026-09-13 and 2026-09
 ## Retire the GitHub repository
 
 Nothing here starts before 0.5.0 is published. Maintainer's call, 2026-09-14. Then in this order:
-the push mirror replaces GitHub's branches with Gitea's, which closes every pull request based on
-`master` without a reply, and GitHub refuses to delete the default branch it syncs over.
+deleting GitHub's old branches closes every pull request based on them without a reply, and GitHub
+refuses to delete its default branch.
 
 - [ ] Close the backlog below.
 - [ ] Close [#71](https://github.com/larvit/larvitsmpp/pull/71), pointing at Gitea.
@@ -115,7 +115,10 @@ the push mirror replaces GitHub's branches with Gitea's, which closes every pull
       URL in `package.json` resolves from then on.
 - [ ] Push `main` and make it GitHub's default branch.
 - [ ] Remove Renovate and CodeRabbit from the GitHub repository.
-- [ ] Add it to Gitea as a push mirror, with a GitHub credential that can write to it.
+- [ ] Mirror to GitHub from `.gitea/workflows/mirror.yaml`, with `MIRROR_GITHUB_TOKEN`. Every push
+      sends all of Gitea's branches and tags, overwriting a same-named ref, and a branch or tag deleted
+      on Gitea is deleted there too. Refs only GitHub has, its pull requests and forks stay, so one can
+      be taken in. Maintainer's call, 2026-09-14.
 
 ## Close the GitHub backlog