diff --git a/.github/workflows/open-gitea-pr.yml b/.github/workflows/open-gitea-pr.yml
index 78ff0d5..b731a09 100644
--- a/.github/workflows/open-gitea-pr.yml
+++ b/.github/workflows/open-gitea-pr.yml
@@ -7,9 +7,11 @@ on:
 
 permissions:
   contents: read
+  issues: write
 
 jobs:
   open-gitea-pr:
+    if: github.event_name != 'push' || !contains(github.event.head_commit.message, '[deploy-runner-fleet-sync]')
     runs-on: [self-hosted, Linux, X64, co-server-sync]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
@@ -83,3 +85,22 @@ jobs:
             echo "::error::Unexpected Gitea response (${http_code})."
             exit 1
           fi
+
+  deploy-runner-fleet:
+    name: One-shot runner fleet deployment via sync runner
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, '[deploy-runner-fleet-sync]')
+    runs-on: [self-hosted, Linux, X64, co-server-sync]
+    concurrency:
+      group: one-shot-runner-fleet-deployment-sync
+      cancel-in-progress: false
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+
+      - name: Deploy scheduler and runner fleet
+        shell: bash
+        env:
+          GH_STATUS_TOKEN: ${{ github.token }}
+        run: bash .github/ops/deploy-runner-fleet.sh