diff --git a/flake-parts/action-ensure-tea-login/default.nix b/flake-parts/action-ensure-tea-login/default.nix
new file mode 100644
index 0000000..d137837
--- /dev/null
+++ b/flake-parts/action-ensure-tea-login/default.nix
@@ -0,0 +1,23 @@
+{
+  perSystem =
+    { config
+    , pkgs
+    , ...
+    }:
+    let
+      name = builtins.baseNameOf ./.;
+      script = config.writers.writePureShellScriptBin
+        name
+        [
+          pkgs.bash
+          pkgs.coreutils
+          pkgs.tea
+        ]
+        ''
+          bash ${./script.sh}
+        '';
+    in
+    {
+      packages.${name} = script;
+    };
+}
diff --git a/flake-parts/action-ensure-tea-login/script.sh b/flake-parts/action-ensure-tea-login/script.sh
new file mode 100644
index 0000000..4185f5d
--- /dev/null
+++ b/flake-parts/action-ensure-tea-login/script.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$(tea login list -o simple | wc -l)" -gt 0 ]; then
+  exit 0
+fi
+
+GITEA_TOKEN="${GITEA_TOKEN:-"$(cat "$GITEA_TOKEN_FILE")"}"
+
+tea login add \
+  --token $GITEA_TOKEN \
+  --url $GITEA_URL