diff --git a/README.md b/README.md
new file mode 100644
index 0000000..2135610
--- /dev/null
+++ b/README.md
@@ -0,0 +1,31 @@
+# studiovitali/actions
+
+Shared Gitea Actions for studio CI workflows.
+
+## Composite actions
+
+- **[`sops`](sops/)** — install checksum-verified SOPS and decrypt `*.sops.*` files with an age key
+- **[`ssh-copy`](ssh-copy/)** — `rsync` a local directory to a remote host over SSH
+- **[`ssh-run`](ssh-run/)** — run a script on a remote host over SSH
+
+Reference a local action from a workflow:
+
+```yaml
+- uses: studio/actions/ssh-run@main
+  with:
+    host: ${{ secrets.HOST }}
+    user: deploy
+    key: ${{ secrets.SSH_KEY }}
+    script: ./deploy.sh
+```
+
+## Runner image
+
+`images/act` builds `git.studiovita.li/studio/actions:ubuntu-latest` from the Gitea
+runner image, adding `rsync` and SOPS. Built weekly and on `images/**` changes via
+[`.gitea/workflows/build.yml`](.gitea/workflows/build.yml).
+
+## Maintenance
+
+Dependencies pinned in `action.yml` / `Dockerfile` are updated by [Renovate](renovate.json)
+using `## renovate:` annotations.