diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3fe316fb0d42976a76d03b991a3beca7685c3e30..13150df3776fed5bd8767cb62278c621056b3fc3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,7 @@
 image: "registry.gitlab.e.foundation/e/os/docker-android-apps-cicd:latest"
 
 stages:
+- update-from-upstream
 - build
 - publish
 
@@ -62,3 +63,55 @@ publish:
            --header 'Content-Type: application/json' --header "PRIVATE-TOKEN: ${PUBLICATION_TOKEN}" \
            --data "{\"ref\":\"${CI_COMMIT_SHA}\",\"name\":\"${CI_COMMIT_TAG}\",\"tag_name\":\"${CI_COMMIT_TAG}\",\"description\":\"${CI_COMMIT_TITLE}\",\"assets\":{\"links\":[{\"name\":\"GmsCore-test.apk\",\"url\":\"https://gitlab.e.foundation/api/v4/projects/149/jobs/artifacts/${CI_COMMIT_TAG}/raw/play-services-core/build/outputs/apk/withMapboxWithNearby/releaseTest/play-services-core-withMapbox-withNearby-releaseTest.apk?job=build-release\",\"link_type\":\"package\"},{\"name\":\"GmsCore-dev.apk\",\"url\":\"https://gitlab.e.foundation/api/v4/projects/149/jobs/artifacts/${CI_COMMIT_TAG}/raw/play-services-core/build/outputs/apk/withMapboxWithNearby/releaseDev/play-services-core-withMapbox-withNearby-releaseDev.apk?job=build-release\",\"link_type\":\"package\"},{\"name\":\"GmsCore-stable.apk\",\"url\":\"https://gitlab.e.foundation/api/v4/projects/149/jobs/artifacts/${CI_COMMIT_TAG}/raw/play-services-core/build/outputs/apk/withMapboxWithNearby/releaseStable/play-services-core-withMapbox-withNearby-releaseStable.apk?job=build-release\",\"link_type\":\"package\"}]}}" \
            --request POST https://gitlab.e.foundation/api/v4/projects/149/releases
+
+.update-from-upstream:
+  image: registry.gitlab.e.foundation/e/tools/docker-tools:latest
+  stage: update-from-upstream
+  rules:
+      - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_REF_NAME == $LOCAL_BRANCH'
+  variables:
+    CI_PROJECT_SSH_URL: git@gitlab.e.foundation:$CI_PROJECT_PATH
+    GIT_STRATEGY: none
+  before_script:
+    - 'command -v ssh-agent >/dev/null || ( apt update -y && apt install openssh-client -y )'
+    - eval $(ssh-agent -s)
+    - echo "${SSH_E_ROBOT_PRIVATE_KEY}" | tr -d '\r' | ssh-add -
+    - mkdir -p ~/.ssh
+    - chmod 700 ~/.ssh
+    - echo "${SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts
+    - echo "${SSH_KNOWN_HOSTS}"
+    - chmod 644 ~/.ssh/known_hosts
+    - git config --global user.email $GITLAB_USER_EMAIL
+    - git config --global user.name "$GITLAB_USER_NAME"
+    - cd $CI_BUILD_DIR
+    - rm -rf $CI_PROJECT_DIR
+    - git clone $CI_PROJECT_SSH_URL $CI_PROJECT_DIR
+    - cd $CI_PROJECT_DIR
+  script:
+# update $UPSTREAM_BRANCH & tags
+    - git fetch origin
+    - git checkout $UPSTREAM_BRANCH
+    - git remote add upstream $UPSTREAM_URL
+    - git fetch upstream
+    - git pull upstream $UPSTREAM_DEFAULT_BRANCH
+    - git push origin $UPSTREAM_BRANCH
+    - git push origin --tags
+# checkout to latest tag commit to $TEMP_LATEST_TAG_BRANCH
+    - git checkout $(git describe --tags --abbrev=0)
+    - git checkout -b $TEMP_LATEST_TAG_BRANCH
+# merge $LOCAL_BRANCH with $TEMP_LATEST_TAG_BRANCH & push
+    - git checkout $LOCAL_BRANCH
+    - git merge $TEMP_LATEST_TAG_BRANCH
+    - git push origin $LOCAL_BRANCH
+# remove unwanted local branch & remote
+    - git branch -D $TEMP_LATEST_TAG_BRANCH
+    - git remote remove upstream
+
+update-default-branch:
+  extends: .update-from-upstream
+  variables:
+    LOCAL_BRANCH: master
+    UPSTREAM_BRANCH: upstream/master
+    UPSTREAM_DEFAULT_BRANCH: main
+    UPSTREAM_URL: https://github.com/microg/GmsCore.git
+    TEMP_LATEST_TAG_BRANCH: latest_upstream_tag_branch