diff --git a/.forgejo/workflows/update.yml b/.forgejo/workflows/update.yml
new file mode 100644
index 0000000..8992715
--- /dev/null
+++ b/.forgejo/workflows/update.yml
@@ -0,0 +1,71 @@
+on:
+  workflow_dispatch:
+  schedule:
+    # 03:42 on Saturdays
+    - cron: '42 3 * * 6'
+env:
+  PR_TITLE: Weekly `cargo update` of dependencies
+  PR_MESSAGE: |
+    Automation to keep dependencies in `Cargo.lock` current.
+
+    The following is the output from `cargo update`:
+  COMMIT_MESSAGE: "chore(deps): cargo update"
+jobs:
+  update-cargo:
+    runs-on: nixos
+    env:
+      BRANCH_NAME: cargo-update
+    steps:
+      - uses: https://git.salame.cl/actions/checkout@v4
+      - run: nix --version
+      - run: nix run .#cargo-update
+      - name: craft PR body and commit message
+        run: |
+          set -xeuo pipefail
+
+          echo "${COMMIT_MESSAGE}" > commit.txt
+          printf '\n\n' >> commit.txt
+          cat cargo_update.log >> commit.txt
+
+          echo "${PR_MESSAGE}" > body.md
+          echo '```txt' >> body.md
+          cat cargo_update.log >> body.md
+          echo '```' >> body.md
+      - name: commit
+        run: |
+          set -xeuo pipefail
+
+          git config user.name forgejo-actions
+          git config user.email forgejo-actions@salame.cl
+          git switch --force-create "$BRANCH_NAME"
+          git add ./Cargo.lock
+          DIFF="$(git diff --staged)"
+          if [[ "$DIFF" == "" ]]; then
+            echo "Cargo.lock was not changed, bailing out and not making a PR"
+            exit 1
+          fi
+          git commit --no-verify --file=commit.txt
+      - name: push
+        run: |
+          set -xeuo pipefail
+          git push --no-verify --force --set-upstream origin "$BRANCH_NAME"
+      - name: open new pull request
+        env:
+          # We have to use a Personal Access Token (PAT) here.
+          # PRs opened from a workflow using the standard `GITHUB_TOKEN` in GitHub Actions
+          # do not automatically trigger more workflows:
+          # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          curl -X POST \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H 'Content-Type: application/json' \
+            -d "$(
+              echo '{}' |
+                jq --arg body "$(cat body.md)" \
+                  --arg title "$COMMIT_MESSAGE" \
+                  --arg head "$BRANCH_NAME" \
+                  '{"body": $body, "title": $title, "head": $head, "base": "main"}'
+            )" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/pulls"
diff --git a/Cargo.lock b/Cargo.lock
index 7bb308f..28442ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -184,9 +184,9 @@ checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
 
 [[package]]
 name = "cc"
-version = "1.2.7"
+version = "1.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
+checksum = "8d6dbb628b8f8555f86d0323c2eb39e3ec81901f4b83e091db8a6a76d316a333"
 dependencies = [
  "shlex",
 ]
diff --git a/flake.lock b/flake.lock
index f7a11d2..63979fc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735774679,
-        "narHash": "sha256-soePLBazJk0qQdDVhdbM98vYdssfs3WFedcq+raipRI=",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f2f7418ce0ab4a5309a4596161d154cfc877af66",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
         "type": "github"
       },
       "original": {
@@ -37,11 +37,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1735834308,
-        "narHash": "sha256-dklw3AXr3OGO4/XT1Tu3Xz9n/we8GctZZ75ZWVqAVhk=",
+        "lastModified": 1735471104,
+        "narHash": "sha256-0q9NGQySwDQc7RhAV2ukfnu7Gxa5/ybJ2ANT8DQrQrs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6df24922a1400241dae323af55f30e4318a6ca65",
+        "rev": "88195a94f390381c6afcdaa933c2f6ff93959cb4",
         "type": "github"
       },
       "original": {
@@ -82,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735905407,
-        "narHash": "sha256-1hKMRIT+QZNWX46e4gIovoQ7H8QRb7803ZH4qSKI45o=",
+        "lastModified": 1735653038,
+        "narHash": "sha256-Q6xAmciTXDtZfUxf6c15QqtRR8BvX4edYPstF/uoqMk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "29806abab803e498df96d82dd6f34b32eb8dd2c8",
+        "rev": "56c0ecd79f7ba01a0ec027da015df751d6ca3ae7",
         "type": "github"
       },
       "original": {