diff --git a/.github/chainguard/fork-sync.sts.yaml b/.github/chainguard/fork-sync.sts.yaml
new file mode 100644
index 000000000..ac1f43564
--- /dev/null
+++ b/.github/chainguard/fork-sync.sts.yaml
@@ -0,0 +1,17 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+
+# Fork-only: lets the "Sync fork with upstream" workflow on main mint a
+# short-lived token to merge basecamp/hey-cli into this fork's main.
+#
+# Workflows write is needed because upstream commits often touch
+# .github/workflows, which GITHUB_TOKEN can never push.
+#
+# The scheduled and manual runs both run on refs/heads/main, so this matches
+# exactly. If this repository opts in to GitHub's immutable OIDC subject, the
+# subject becomes repo:justanotherspy@4822513/hey-cli@<repo id>:ref:refs/heads/main.
+issuer: https://token.actions.githubusercontent.com
+subject: repo:justanotherspy/hey-cli:ref:refs/heads/main
+
+permissions:
+  contents: write
+  workflows: write
diff --git a/.github/workflows/fork-sync-upstream.yml b/.github/workflows/fork-sync-upstream.yml
new file mode 100644
index 000000000..25ee09cbe
--- /dev/null
+++ b/.github/workflows/fork-sync-upstream.yml
@@ -0,0 +1,35 @@
+# Fork-only: keeps justanotherspy/hey-cli's main current with basecamp/hey-cli.
+#
+# This fork exists for one reason: it drops bin/.keep, because the claude.ai
+# marketplace sync refuses a plugin with a top-level bin/ directory. Everything
+# else comes from upstream, merged in daily.
+#
+# The token comes from octo-sts (trust policy: .github/chainguard/fork-sync.sts.yaml),
+# not a stored secret: GITHUB_TOKEN cannot push upstream commits that change
+# .github/workflows, and a short-lived token beats a long-lived PAT.
+name: Sync fork with upstream
+
+on:
+  schedule:
+    - cron: '23 5 * * *'
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+
+jobs:
+  sync:
+    if: github.repository == 'justanotherspy/hey-cli'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: sts
+        with:
+          scope: justanotherspy/hey-cli
+          identity: fork-sync
+
+      - name: Merge basecamp/hey-cli main into main
+        env:
+          GH_TOKEN: ${{ steps.sts.outputs.token }}
+          REPO: ${{ github.repository }}
+        run: gh api --method POST "repos/${REPO}/merge-upstream" -f branch=main
diff --git a/bin/.keep b/bin/.keep
deleted file mode 100644
index e69de29bb..000000000