diff --git a/bin/deploy/systemd/conservancy-www-update.sh b/bin/deploy/systemd/conservancy-www-update.sh
new file mode 100755
index 0000000000000000000000000000000000000000..d059a8d281f55ea724adc68c59c95688e7f6822f
--- /dev/null
+++ b/bin/deploy/systemd/conservancy-www-update.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Pull in and apply Conservancy website updates from the git repository.
+#
+# This is intended to be run on a timer. Note that it does *not* restart the
+# Django application or run the migrate and collectstatic commands.
+
+set -e
+set -u
+set -x
+
+PRODUCTION_BRANCH="${PRODUCTION_BRANCH:-master}"
+
+git_rev_name() {
+    git rev-parse --abbrev-ref --symbolic-full-name "$@"
+}
+
+# If the checkout is not on the production branch,
+# assume maintenance is happening and stop.
+if [ "$(git_rev_name HEAD)" != "$PRODUCTION_BRANCH" ]; then
+    exit 0
+fi
+
+# Abort if the production branch isn't tracking a remote branch.
+if ! git_upstream="$(git_rev_name '@{upstream}' 2>/dev/null)"; then
+    exit 3
+fi
+
+IFS=/ read git_remote git_refspec <<EOF
+$git_upstream
+EOF
+git fetch --quiet --no-tags "$git_remote" "$git_refspec"
+if [ "$(git rev-parse "$PRODUCTION_BRANCH")" = "$(git rev-parse "$git_upstream")" ]; then
+    exit 0
+fi
+
+exitcode=0
+git merge --quiet --ff-only "${git_remote}/${git_refspec}"
+python3 -m compileall -q -x - conservancy || exitcode=$?
+chgrp -R www-data conservancy || exitcode=$?
+chmod -R g+rX-w,o+X-w conservancy || exitcode=$?
+chmod -R o+r conservancy/static || exitcode=$?
+exit "$exitcode"