diff --git a/.gitea/workflows/sync-upstream.yml b/.gitea/workflows/sync-upstream.yml
new file mode 100644
index 00000000..fc53a8b1
--- /dev/null
+++ b/.gitea/workflows/sync-upstream.yml
@@ -0,0 +1,40 @@
+name: Sync from upstream
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: '要同步的 release tag（留空则同步到 upstream/main 的最新 tag）'
+        required: false
+        default: ''
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.SYNC_TOKEN }}
+
+      - name: Sync main to release tag
+        run: |
+          git config user.name "gitea-actions"
+          git config user.email "actions@gitea.local"
+          git remote add upstream https://gitea.zhengchentao.win/<mirror路径>/ezbookkeeping.git
+          git fetch upstream --tags
+
+          if [ -n "${{ inputs.tag }}" ]; then
+            TARGET="${{ inputs.tag }}"
+          else
+            # 自动找 upstream 最新 tag（按版本号排序）
+            TARGET=$(git tag -l --sort=-v:refname | head -n 1)
+          fi
+
+          echo "==> Syncing main to $TARGET"
+          git rev-parse "$TARGET" || { echo "❌ Tag $TARGET not found"; exit 1; }
+
+          git checkout main
+          git reset --hard "$TARGET"
+          git push origin main --force-with-lease
+          git push origin "$TARGET"   # tag 也推到 dev 仓库
\ No newline at end of file