diff --git a/README.md b/README.md
index ae07e3e..8dc339d 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@ source in the `PKGBUILD` (and drop the `-bin` suffix), or don't package it.
 
 | Package | Upstream | Upstream deliverable | AUR |
 |---|---|---|---|
+| `cachy-auto-update` | [Felitendo/cachy-auto-update](https://github.com/Felitendo/cachy-auto-update) — unattended background updates for CachyOS (pacman, AUR, Flatpak, AppImages) | *built from source* | [cachy-auto-update](https://aur.archlinux.org/packages/cachy-auto-update) |
 | `chiaki-ng-bin` | [streetpea/chiaki-ng](https://github.com/streetpea/chiaki-ng) — PlayStation Remote Play client (Qt6) | AppImage | [chiaki-ng-bin](https://aur.archlinux.org/packages/chiaki-ng-bin) |
 | `chromium-widevine-helper` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | *no build step* | [chromium-widevine-helper](https://aur.archlinux.org/packages/chromium-widevine-helper) |
 | `faugus-launcher-bin` | [Faugus/faugus-launcher](https://github.com/Faugus/faugus-launcher) — launcher for Windows games via UMU-Launcher | `.deb` (`all`) | [faugus-launcher-bin](https://aur.archlinux.org/packages/faugus-launcher-bin) |
diff --git a/cachy-auto-update/.SRCINFO b/cachy-auto-update/.SRCINFO
new file mode 100644
index 0000000..1b3e68a
--- /dev/null
+++ b/cachy-auto-update/.SRCINFO
@@ -0,0 +1,29 @@
+pkgbase = cachy-auto-update
+	pkgdesc = Unattended background updates for CachyOS, aware of battery, gaming and manual package management
+	pkgver = 1.0.0
+	pkgrel = 1
+	url = https://github.com/Felitendo/cachy-auto-update
+	install = cachy-auto-update.install
+	arch = any
+	license = GPL-3.0-or-later
+	makedepends = gettext
+	makedepends = scdoc
+	depends = bash
+	depends = systemd
+	depends = pacman
+	depends = pacman-contrib
+	depends = util-linux
+	depends = sudo
+	depends = gettext
+	optdepends = paru: AUR package updates
+	optdepends = yay: AUR package updates
+	optdepends = base-devel: required to build AUR packages
+	optdepends = flatpak: Flatpak updates
+	optdepends = libnotify: desktop notifications
+	optdepends = gearlever: AppImage updates
+	backup = etc/cachy-auto-update/cachy-auto-update.conf
+	backup = etc/logrotate.d/cachy-auto-update
+	source = cachy-auto-update-1.0.0.tar.gz::https://github.com/Felitendo/cachy-auto-update/archive/refs/tags/v1.0.0.tar.gz
+	sha256sums = e0ed0e3d76174de6d49625236487af90da0071a3ff54588a327020fd90a6db32
+
+pkgname = cachy-auto-update
diff --git a/cachy-auto-update/PKGBUILD b/cachy-auto-update/PKGBUILD
new file mode 100644
index 0000000..661bb23
--- /dev/null
+++ b/cachy-auto-update/PKGBUILD
@@ -0,0 +1,33 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=cachy-auto-update
+pkgver=1.0.0
+pkgrel=1
+pkgdesc="Unattended background updates for CachyOS, aware of battery, gaming and manual package management"
+arch=('any')
+url="https://github.com/Felitendo/cachy-auto-update"
+license=('GPL-3.0-or-later')
+depends=('bash' 'systemd' 'pacman' 'pacman-contrib' 'util-linux' 'sudo'
+         'gettext')
+makedepends=('gettext' 'scdoc')
+optdepends=('paru: AUR package updates'
+            'yay: AUR package updates'
+            'base-devel: required to build AUR packages'
+            'flatpak: Flatpak updates'
+            'libnotify: desktop notifications'
+            'gearlever: AppImage updates')
+backup=('etc/cachy-auto-update/cachy-auto-update.conf'
+        'etc/logrotate.d/cachy-auto-update')
+install="${pkgname}.install"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
+sha256sums=('e0ed0e3d76174de6d49625236487af90da0071a3ff54588a327020fd90a6db32')
+
+build() {
+  make -C "${pkgname}-${pkgver}"
+}
+
+package() {
+  make -C "${pkgname}-${pkgver}" DESTDIR="$pkgdir" install
+}
diff --git a/cachy-auto-update/cachy-auto-update.install b/cachy-auto-update/cachy-auto-update.install
new file mode 100644
index 0000000..19093a8
--- /dev/null
+++ b/cachy-auto-update/cachy-auto-update.install
@@ -0,0 +1,37 @@
+_check_sudoers() {
+  # A malformed drop-in in /etc/sudoers.d takes sudo down for the whole
+  # machine, so say so loudly rather than leaving it to be discovered later.
+  if command -v visudo > /dev/null 2>&1; then
+    if ! visudo -cf /etc/sudoers.d/cachy-auto-update > /dev/null 2>&1; then
+      printf '\n  WARNING: /etc/sudoers.d/cachy-auto-update did not validate.\n' >&2
+      printf '  AUR updates will not work until this is resolved.\n\n' >&2
+    fi
+  fi
+}
+
+post_install() {
+  _check_sudoers
+
+  cat <<'EOF'
+
+  cachy-auto-update is installed but not active yet.
+
+    sudo cachy-auto-update          interactive setup
+    sudo cachy-auto-update enable   turn automatic updates on
+    sudo cachy-auto-update status   see what it would do right now
+
+  AUR packages are built by a locked system account that is allowed to call
+  pacman without a password (/etc/sudoers.d/cachy-auto-update). No user
+  password is stored anywhere. Set UpdateAUR=no in
+  /etc/cachy-auto-update/cachy-auto-update.conf to opt out of that entirely.
+
+EOF
+}
+
+post_upgrade() {
+  _check_sudoers
+}
+
+pre_remove() {
+  systemctl disable --now cachy-auto-update.timer > /dev/null 2>&1 || true
+}
diff --git a/cachy-auto-update/pkg.sh b/cachy-auto-update/pkg.sh
new file mode 100644
index 0000000..0797ac3
--- /dev/null
+++ b/cachy-auto-update/pkg.sh
@@ -0,0 +1,27 @@
+# cachy-auto-update - unattended background updates for CachyOS
+# (https://github.com/Felitendo/cachy-auto-update).
+#
+# Pure shell plus a gettext catalog and a scdoc man page, so the PKGBUILD just
+# runs the upstream Makefile against the release tarball. Nothing is prebuilt
+# and nothing is republished - the AUR package builds exactly what the tag
+# contains.
+
+UPSTREAM_REPO="Felitendo/cachy-auto-update"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(gettext scdoc)
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}