diff --git a/.github/scripts/inventory.ts b/.github/scripts/inventory.ts
new file mode 100755
index 00000000..4e08b4d3
--- /dev/null
+++ b/.github/scripts/inventory.ts
@@ -0,0 +1,17 @@
+#!/usr/bin/env -S pkgx deno run --allow-net
+
+const [project] = Deno.args
+
+let versions: string[] = []
+
+for (const platform of ["linux", "darwin"]) {
+  for (const arch of ["x86-64", "aarch64"]) {
+    const url = `https://dist.pkgx.dev/${project}/${platform}/${arch}/versions.txt`
+    const txt = await (await fetch(url)).text()
+    versions.push(...txt.split("\n"))
+  }
+}
+
+versions = [...new Set(versions.filter(x => x.trim()))]
+
+console.log(JSON.stringify(versions))
diff --git a/.github/workflows/restock.yml b/.github/workflows/restock.yml
new file mode 100644
index 00000000..faa5fca7
--- /dev/null
+++ b/.github/workflows/restock.yml
@@ -0,0 +1,34 @@
+name: restock project inventory
+run-name: rebuilding ${{ inputs.project }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      project:
+        description: a single project, eg. `foo.com`
+        required: true
+        type: string
+
+jobs:
+  ingest:
+    runs-on: ubuntu-latest
+    outputs:
+      versions: ${{ steps.fetch.outputs.plan }}
+    steps:
+      - uses: pkgxdev/setup@v2
+      - uses: actions/checkout@v4
+      - run: ./.github/actions/inventory.ts ${{ inputs.project }}
+        id: fetch
+
+  pkg:
+    needs: ingest
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ${{ fromJSON(needs.ingest.outputs.versions) }}
+    uses: ./.github/workflows/pkg.yml
+    permissions:
+      issues: write  #FIXME we don’t want this but I don’t think we can alter the way permissions are inherited
+    with:
+      pkg: ${{inputs.project}}=${{ matrix.version }}
+    secrets: inherit