diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0bbb2c1a..a4a4825d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,7 @@
 stages:
   - host_test
+  - deploy
+
 image: ${CI_DOCKER_REGISTRY}/esp32-ci-env
 
 variables:
@@ -30,3 +32,24 @@ run_lwip_unittests:
     # build and run tests
     - make "TESTFILES=$TESTFILES" check
 
+.add_gh_key_remote: &add_gh_key_remote |
+  command -v ssh-agent >/dev/null || exit 1
+  eval $(ssh-agent -s)
+  printf '%s\n' "${GH_PUSH_KEY}" | tr -d '\r' | ssh-add - > /dev/null
+  mkdir -p ~/.ssh && chmod 700 ~/.ssh
+  [[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config || ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
+  git remote remove github || true
+  git remote add github ${GH_PUSH_REPO}
+
+push_master_to_github:
+  stage: deploy
+  only:
+    - 2.1.2-esp
+  when: on_success
+  variables:
+    GIT_STRATEGY: clone
+  script:
+    - *add_gh_key_remote
+    - "[ -n \"${CI_COMMIT_TAG:-}\" ] && git push github ${CI_COMMIT_TAG}"
+    - "[ -z \"${CI_COMMIT_TAG:-}\" ] && git push github ${CI_COMMIT_SHA}:refs/heads/${CI_COMMIT_REF_NAME}"
+