diff --git a/.gitea/workflows/certificates.yaml b/.gitea/workflows/certificates.yaml
new file mode 100644
index 0000000..21074f0
--- /dev/null
+++ b/.gitea/workflows/certificates.yaml
@@ -0,0 +1,26 @@
+name: Build certificates
+
+on:
+  workflow_dispatch:
+    # Note: this doesn't work on current gitea for some reason?
+    build_certs:
+      description: Build certificates from scratch
+      type: boolean
+      required: true
+      default: false
+env:
+  TZ: America/Chicago
+jobs:
+  deploy:
+    name: Setup/Renew certificates
+    runs-on: homelab
+    steps:
+      - name: "Build certificates"
+        if: inputs.build_certs
+        run: |
+          cd /home/matthew/homelab
+          bash ./build-certs.sh
+      - name: "Renew certificates"
+        run: |
+          cd /home/matthew/homelab
+          docker compose run --rm certbot renew