diff --git a/.mrconfig b/.mrconfig
index 56f6a92..090d612 100644
--- a/.mrconfig
+++ b/.mrconfig
@@ -1,235 +1,238 @@
+[DEFAULT]
+git_pullup = "$(dirname "$MR_CONFIG")/bin/pull-from-upstream"
+
 [swh-site]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-site.git swh-site \
 	 && cd swh-site \
 	 && git checkout -b production origin/production
 
 [swh-profile]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-profile.git swh-profile
 
 [swh-role]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-role.git swh-role
 
 [swh-dar]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-dar.git swh-dar
 
 [swh-gunicorn]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-gunicorn.git swh-gunicorn
 
 [swh-mediawiki]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-mediawiki.git swh-mediawiki
 
 [swh-postfix]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-postfix.git swh-postfix
 
 [swh-systemd]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-systemd.git swh-systemd
 
 [swh-uwsgi]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-swh-uwsgi.git swh-uwsgi
 
 [private/swh-private-data]
 checkout = git clone git@forge.softwareheritage.org:/source/puppet-swh-private-data.git swh-private-data
 
 [claranet-varnish]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-claranet-varnish.git claranet-varnish \
 	 && cd claranet-varnish \
 	 && git remote add upstream https://github.com/claranet/puppet-varnish \
 	 && git fetch upstream
 
 [icinga-icinga2]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-icinga-icinga2.git icinga-icinga2 \
 	 && cd icinga-icinga2 \
 	 && git remote add upstream https://github.com/icinga/puppet-icinga2 \
 	 && git fetch upstream
 
 [icinga-icingaweb2]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-icinga-icingaweb2.git icinga-icingaweb2 \
 	 && cd icinga-icingaweb2 \
 	 && git remote add upstream https://github.com/icinga/puppet-icingaweb2 \
 	 && git fetch upstream
 
 [inkblot-bind]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-inkblot-bind.git inkblot-bind \
 	 && cd inkblot-bind \
 	 && git remote add upstream https://github.com/inkblot/puppet-bind \
 	 && git fetch upstream
 
 [puppet-extlib]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppet-extlib.git puppet-extlib \
 	 && cd puppet-extlib \
 	 && git remote add upstream https://github.com/voxpupuli/puppet-extlib \
 	 && git fetch upstream
 
 [puppet-nginx]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppet-nginx.git puppet-nginx \
 	 && cd puppet-nginx \
 	 && git remote add upstream https://github.com/voxpupuli/puppet-nginx \
 	 && git fetch upstream
 
 [puppet-unattended_upgrades]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppet-unattended_upgrades.git puppet-unattended_upgrades \
 	 && cd puppet-unattended_upgrades \
 	 && git remote add upstream https://github.com/voxpupuli/puppet-unattended_upgrades \
 	 && git fetch upstream
 
 [puppetlabs-apache]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-apache.git puppetlabs-apache \
 	 && cd puppetlabs-apache \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-apache \
 	 && git fetch upstream
 
 [puppetlabs-apt]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-apt.git puppetlabs-apt \
 	 && cd puppetlabs-apt \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-apt \
 	 && git fetch upstream
 
 [puppetlabs-concat]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-concat.git puppetlabs-concat \
 	 && cd puppetlabs-concat \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-concat \
 	 && git fetch upstream
 
 [puppetlabs-inifile]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-inifile.git puppetlabs-inifile \
 	 && cd puppetlabs-inifile \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-inifile\
 	 && git fetch upstream
 
 [puppetlabs-mysql]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-mysql.git puppetlabs-mysql \
 	 && cd puppetlabs-mysql \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-mysql \
 	 && git fetch upstream
 
 [puppetlabs-ntp]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-ntp.git puppetlabs-ntp \
 	 && cd puppetlabs-ntp \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-ntp \
 	 && git fetch upstream
 
 [puppetlabs-postgresql]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-postgresql.git puppetlabs-postgresql \
 	 && cd puppetlabs-postgresql \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-postgresql \
 	 && git fetch upstream
 
 [puppetlabs-puppetdb]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-puppetdb.git puppetlabs-puppetdb \
 	 && cd puppetlabs-puppetdb \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-puppetdb \
 	 && git fetch upstream
 
 [puppetlabs-stdlib]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-stdlib.git puppetlabs-stdlib \
 	 && cd puppetlabs-stdlib \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-stdlib \
 	 && git fetch upstream
 
 [puppetlabs-vcsrepo]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-puppetlabs-vcsrepo.git puppetlabs-vcsrepo \
 	 && cd puppetlabs-vcsrepo \
 	 && git remote add upstream https://github.com/puppetlabs/puppetlabs-vcsrepo\
 	 && git fetch upstream
 
 [mosen-cups]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-mosen-cups.git mosen-cups \
 	 && cd mosen-cups \
 	 && git remote add upstream https://github.com/mosen/puppet-cups \
 	 && git fetch upstream
 
 [openstack-ceph]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-openstack-ceph.git openstack-ceph \
 	 && cd openstack-ceph \
 	 && git remote add upstream https://github.com/openstack/puppet-ceph \
 	 && git fetch upstream
 
 [ripienaar-module_data]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-ripienaar-module_data.git ripienaar-module_data \
 	 && cd ripienaar-module_data \
 	 && git remote add upstream https://github.com/ripienaar/puppet-module-data \
 	 && git fetch upstream
 
 [rlenglet-debconf_package]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-rlenglet-debconf_package.git rlenglet-debconf_package \
 	 && cd rlenglet-debconf_package \
 	 && git remote add upstream https://github.com/rlenglet/puppet-debconf_package \
 	 && git fetch upstream
 
 [saz-locales]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-saz-locales.git saz-locales \
 	 && cd saz-locales \
 	 && git remote add upstream https://github.com/saz/puppet-locales \
 	 && git fetch upstream
 
 [saz-memcached]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-saz-memcached.git saz-memcached \
 	 && cd saz-memcached \
 	 && git remote add upstream https://github.com/saz/puppet-memcached \
 	 && git fetch upstream
 
 [saz-resolv_conf]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-saz-resolv_conf.git saz-resolv_conf \
 	 && cd saz-resolv_conf \
 	 && git remote add upstream https://github.com/saz/puppet-resolv_conf \
 	 && git fetch upstream
 
 [saz-ssh]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-saz-ssh.git saz-ssh \
 	 && cd saz-ssh \
 	 && git remote add upstream https://github.com/saz/puppet-ssh \
 	 && git fetch upstream
 
 [saz-sudo]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-saz-sudo.git saz-sudo \
 	 && cd saz-sudo \
 	 && git remote add upstream https://github.com/saz/puppet-sudo \
 	 && git fetch upstream
 
 [saz-timezone]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-saz-timezone.git saz-timezone \
 	 && cd saz-timezone \
 	 && git remote add upstream https://github.com/saz/puppet-timezone \
 	 && git fetch upstream
 
 [ssm-hitch]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-ssm-hitch.git ssm-hitch \
 	 && cd ssm-hitch \
 	 && git remote add upstream https://github.com/ssm/ssm-hitch \
 	 && git fetch upstream
 
 [ssm-munin]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-ssm-munin.git ssm-munin \
 	 && cd ssm-munin \
 	 && git remote add upstream https://github.com/ssm/ssm-munin \
 	 && git fetch upstream
 
 [stm-debconf]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-stm-debconf.git stm-debconf \
 	 && cd stm-debconf \
 	 && git remote add upstream https://github.com/smoeding/puppet-debconf \
 	 && git fetch upstream
 
 [theforeman-puppet]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-theforeman-puppet.git theforeman-puppet \
 	 && cd theforeman-puppet \
 	 && git remote add upstream https://github.com/theforeman/puppet-puppet \
 	 && git fetch upstream
 
 [thias-php]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-thias-php.git thias-php \
 	 && cd thias-php \
 	 && git remote add upstream https://github.com/thias/puppet-php \
 	 && git fetch upstream
 
 [trepasi-debnet]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-trepasi-debnet.git trepasi-debnet \
 	 && cd trepasi-debnet \
 	 && git remote add upstream https://github.com/rtib/tib-debnet \
 	 && git fetch upstream
 
 [wikimedia-kafka]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-wikimedia-kafka.git wikimedia-kafka
 
 [wikimedia-zookeeper]
 checkout = git clone https://forge.softwareheritage.org/source/puppet-wikimedia-zookeeper.git wikimedia-zookeeper
diff --git a/bin/pull-from-upstream b/bin/pull-from-upstream
new file mode 100755
index 0000000..854b0a6
--- /dev/null
+++ b/bin/pull-from-upstream
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -e
+
+if [ -d .git/refs/remotes/upstream ]; then
+    git fetch upstream
+
+    oldbranch=$(git rev-parse --abbrev-ref HEAD)
+
+    if [ "$oldbranch" != "master" ]; then
+        git checkout master
+    fi
+
+    git merge upstream/master
+    git push origin master:master --tags
+
+    if [ "$oldbranch" != "master" ]; then
+        git checkout $oldbranch
+    fi
+fi