diff --git a/.github/workflows/.github/workflows/gitspiegel-trigger.yml b/.github/workflows/.github/workflows/gitspiegel-trigger.yml
new file mode 100644
index 000000000000..b338f7a3f625
--- /dev/null
+++ b/.github/workflows/.github/workflows/gitspiegel-trigger.yml
@@ -0,0 +1,34 @@
+name: gitspiegel sync
+
+# This workflow doesn't do anything, it's only use is to trigger "workflow_run"
+# webhook, that'll be consumed by gitspiegel
+# This way, gitspiegel won't do mirroring, unless this workflow runs,
+# and running the workflow is protected by GitHub
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - unlocked
+      - ready_for_review
+      - reopened
+  # the job doesn't check out any code, so it is relatively safe to run it on any event
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - unlocked
+      - ready_for_review
+      - reopened
+  merge_group:
+
+# drop all permissions for GITHUB_TOKEN
+permissions: {}
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Do nothing
+        run: echo "let's go"