diff --git a/systemd/conservancy-www-update.sh b/systemd/conservancy-www-update.sh
new file mode 100755
index 0000000000000000000000000000000000000000..1e7b18f081eec125a6412cac37e5a033e3b9d653
--- /dev/null
+++ b/systemd/conservancy-www-update.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+set -e
+set -u
+
+PRODUCTION_BRANCH="${PRODUCTION_BRANCH:-master}"
+
+git_rev_name() {
+    git rev-parse --abbrev-ref --symbolic-full-name "$@"
+}
+
+# If the checkout is not on the production branch,
+# assume maintenance is happening and stop.
+if [ "$(git_rev_name HEAD)" != "$PRODUCTION_BRANCH" ]; then
+    exit 0
+fi
+
+# Abort if the production branch isn't tracking a remote branch.
+if ! git_upstream="$(git_rev_name '@{upstream}' 2>/dev/null)"; then
+    exit 3
+fi
+
+IFS=/ read git_remote git_refspec <<EOF
+$git_upstream
+EOF
+git fetch --quiet --no-tags "$git_remote" "$git_refspec"
+if [ "$(git rev-parse "$PRODUCTION_BRANCH")" = "$(git rev-parse "$git_upstream")" ]; then
+    exit 0
+fi
+
+exitcode=0
+git merge --quiet --ff-only "$git_remote" "$git_refspec"
+python2 -m compileall -q -x - www || exitcode=$?
+chgrp -R www-data www || exitcode=$?
+chmod -R g+rX-w,o+X-w www || exitcode=$?
+chmod -R o+r www/conservancy/static || exitcode=$?
+exit "$exitcode"