diff --git a/.ci/registry-login.sh b/.ci/registry-login.sh
new file mode 100755
index 0000000..cc3122b
--- /dev/null
+++ b/.ci/registry-login.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# SPDX-License-Identifier: Apache-2.0
+# (c) 2024, Konstantin Demin
+set -ef
+
+[ -z "${CI_DEBUG}" ] || set -xv
+
+. .ci/envsh.registry
+
+for i ; do
+    skopeo login "$i" </dev/null
+done
diff --git a/.woodpecker/.build.yml b/.woodpecker/.build.yml
index 9c326ae..612bfad 100644
--- a/.woodpecker/.build.yml
+++ b/.woodpecker/.build.yml
@@ -30,10 +30,7 @@ steps:
       MALLOC_ARENA_MAX: "4"
     secrets: [ REGISTRY_AUTH ]
     commands:
-      - |
-        . .ci/envsh.registry
-        skopeo login quay.krd.sh </dev/null
-        skopeo login docker.io </dev/null
+      - .ci/registry-login.sh quay.krd.sh docker.io
 
   - name: build-all
     image: *go_image
@@ -60,6 +57,7 @@ steps:
       IMAGE_NAME: *image_name
     secrets: [ REGISTRY_AUTH ]
     commands:
+      - .ci/registry-login.sh quay.krd.sh
       - .ci/image-all.sh
 
   - name: image-sync
@@ -72,6 +70,7 @@ steps:
       EXT_IMAGE_NAME: *ext_image_name
     secrets: [ REGISTRY_AUTH ]
     commands:
+      - .ci/registry-login.sh quay.krd.sh docker.io
       - .ci/sync-all.sh
 
 ## personal tweaks :)
diff --git a/.woodpecker/.sync.yml b/.woodpecker/.sync.yml
new file mode 100644
index 0000000..291d660
--- /dev/null
+++ b/.woodpecker/.sync.yml
@@ -0,0 +1,36 @@
+when:
+  - event: [ manual ]
+    evaluate: 'CI_DEBUG == "sync"'
+
+variables:
+  - &image_name 'quay.krd.sh/krd/woodpecker-sonatype-nexus'
+  - &ext_image_name 'docker.io/rockdrilla/woodpecker-sonatype-nexus'
+  - &skopeo_image 'quay.krd.sh/quay_io/containers/skopeo:v1.15.0'
+
+## kind of fixup (remove in near future)
+## ref: https://github.com/woodpecker-ci/plugin-git/releases
+clone:
+  git:
+    image: quay.krd.sh/docker_io/woodpeckerci/plugin-git:2.5.0
+
+## NB: ${variable} expressions are subject to pre-processing.
+## ref: https://woodpecker-ci.org/docs/usage/environment
+
+steps:
+
+  - name: image-sync
+    image: *skopeo_image
+    environment:
+      GOMAXPROCS: "4"
+      MALLOC_ARENA_MAX: "4"
+      ##
+      IMAGE_NAME: *image_name
+      EXT_IMAGE_NAME: *ext_image_name
+    secrets: [ REGISTRY_AUTH ]
+    commands:
+      - .ci/registry-login.sh quay.krd.sh docker.io
+      - .ci/sync-all.sh
+
+## personal tweaks :)
+labels:
+  network: dmz