diff --git a/.woodpecker/upgrade-submodule.yaml b/.woodpecker/upgrade-submodule.yaml
new file mode 100644
index 0000000..d57e8b5
--- /dev/null
+++ b/.woodpecker/upgrade-submodule.yaml
@@ -0,0 +1,23 @@
+when:
+  - event: manual
+  - event: cron
+    cron: update_submodules
+
+steps:
+  - name: submodule update
+    secrets: [deploy_key]
+    image: debian:bookworm-backports
+    commands:
+      - mkdir ~/.ssh && echo "$DEPLOY_KEY" > ~/.ssh/id_deploy_key && cp ssh_known_hosts ~/.ssh/known_hosts
+      - ls -lah ~/.ssh
+      - cat ~/.ssh/id_deploy_key
+      - chmod go-rwX -Rv ~/.ssh
+        #        ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
+      - apt update && apt install -y git git-lfs
+      - git config core.sshCommand 'ssh -vi ~/.ssh/id_deploy_key -o IdentitiesOnly=yes'
+      - git config --global user.email 'ci-updater@simcop2387.info'
+      - git config --global user.name  'CI Auto-updater'
+      - git config --global pull.rebase false
+      - ./update-submodules.sh
+      - git remote set-url origin git@gitea.simcop2387.info:simcop2387/vllm-containers.git
+      - GIT_TRACE=1 git push origin HEAD
diff --git a/update-submodules.sh b/update-submodules.sh
new file mode 100755
index 0000000..6c5d422
--- /dev/null
+++ b/update-submodules.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+git submodule foreach --recursive git fetch --all
+git submodule foreach git reset --hard origin/main
+git diff-index --quiet HEAD || git commit -am 'Automatic update submodule'