diff --git a/ci/pipeline.yaml b/ci/pipeline.yaml
new file mode 100644
index 0000000..836dd3f
--- /dev/null
+++ b/ci/pipeline.yaml
@@ -0,0 +1,48 @@
+---
+resources:
+- name: every-day
+  type: time
+  source:
+    interval: 24h
+
+- name: script
+  type: git
+  source:
+    uri: https://gitea.redxef.at/redxef/wp-cal-integration
+    branch: test
+
+
+jobs:
+- name: update-calendar
+  plan:
+  - get: every-day
+    trigger: true
+  - get: script
+  - task: run-update
+    config:
+      platform: linux
+      image_resource:
+        type: registry-image
+        source:
+          repository: alpine
+      inputs:
+      - name: script
+        path: .
+      params:
+        VAULT_TOKEN: ((vault_token.token))
+      run:
+        path: sh
+        args:
+        - -c
+        - |
+          #!/usr/bin/env sh
+          apk --no-cache --update add \
+              libcap vault jq \
+              python3 py3-pip py3-yaml \
+              py3-google-api-python-client \
+              py3-google-auth-httplib2 \
+              && python3 -m pip install google-auth-oauthlib
+          setcap cap_ipc_lock= "$(command -v vault)"
+          vault read -address https://vault.redxef.at -format json secret/data/scouts/google/website/wp-cal-integration \
+              | jq .data.data \
+              | ./main.py