diff --git a/.github/workflows/mirror_to_gitlab.yaml b/.github/workflows/mirror_to_gitlab.yaml
new file mode 100644
index 0000000000..e605458ad9
--- /dev/null
+++ b/.github/workflows/mirror_to_gitlab.yaml
@@ -0,0 +1,55 @@
+name: Mirror to GitLab
+
+on:
+  push:
+  delete:
+  workflow_dispatch:  # This enables manual triggering
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Wait for other instances of this workflow to conclude
+        uses: softprops/turnstyle@8db075d65b19bf94e6e8687b504db69938dc3c65
+        with:
+          same-branch-only: 'true'
+          abort-after-seconds: 300
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Checkout Repository
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0  # Fetch full history
+
+      - name: Set up Git
+        run: |
+          git config --global user.name 'GitHub Action'
+          git config --global user.email 'action@github.com'
+
+      - name: Set up SSH
+        uses: webfactory/ssh-agent@v0.5.3
+        with:
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+
+      - name: Add GitLab public keys
+        run: |
+          ssh-keyscan -H gitlab.com >> ~/.ssh/known_hosts
+
+      - name: Sync and commit changes
+        id: sync-and-commit
+        run: |
+          git lfs pull
+
+          # Add GitLab remote
+          git remote add gitlab git@gitlab.com:sunnypilot/sunnyhaibin/sunnypilot-github-mirror.git
+
+          # Fetch from GitLab and check if the branch exists
+          if git fetch gitlab ${{ github.ref }}; then
+              # Merge changes from GitLab if the branch exists
+              git merge gitlab/${{ github.ref_name }} --allow-unrelated-histories --strategy-option=theirs
+          else
+              echo "Branch does not exist on GitLab, skipping merge."
+          fi
+          git push -u gitlab ${{ github.ref }} # If you have issues with "push rejected missing LFS" or something. Make sure you disabled LFS on the GITLAB repo if you intend to use a different LFS repo other than the target repo
\ No newline at end of file
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8ac6797adb..33d6289f63 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,12 +9,8 @@ variables:
   GIT_CONFIG_USER_EMAIL: "gitlab@pipeline.com"
   GIT_CONFIG_USER_NAME: "Gitlab Pipeline"
   PUBLIC_REPO_URL: "https://github.com/sunnyhaibin/sunnypilot"
-  GIT_CRYPT_INSTALL_PATH: ".git-crypt/keys/install_new_key_sp"
-  GIT_CRYPT_KEY_PATH: ".git-crypt/keys/default/0"
-
 
 stages:
-  - git-crypt-auto-provision
   - build
   - sanity
   - publish
@@ -26,29 +22,11 @@ default:
     - sunnypilot
     - x86
 
-.configure_ci_deploy_key: &configure_ci_deploy_key
-  - 'eval $(ssh-agent -s)'
-  - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
-  - 'mkdir -p ~/.ssh/'
-  - 'chmod 700 ~/.ssh'
-  - export HOST=$(echo ${GIT_ORIGIN} | cut -d'@' -f2 | cut -d':' -f1)
-  - 'if [ -z "$HOST" ]; then export HOST="gitlab.com"; fi' # Fallback to gitlab.com if HOST is not defined
-  - echo fetching ssh pub keys for ${HOST}
-  - 'ssh-keyscan -H ${HOST} >> ~/.ssh/known_hosts' # Adding gitlab to trusted
-  - 'chmod 644 ~/.ssh/known_hosts'
-
-.configure_git: &configure_git
-  - 'git config --global user.email "${GIT_CONFIG_USER_EMAIL}"'
-  - 'git config --global user.name "${GIT_CONFIG_USER_NAME}"'
-  # Replace the URL with the SSH version
-  - export NEW_URL=$(echo ${CI_REPOSITORY_URL} | sed -E "s#^(https?://)?[^@]+@([^/]+)/(.*)#git@\2:\3#")
-  - git remote set-url --push origin ${NEW_URL}
-  - git remote -v
-
 .default_before_script: &default_before_script
   - 'export VERSION=$(eval $VERSION)${EXTRA_VERSION_IDENTIFIER}'
   - 'mkdir -p "${BUILD_DIR}/"'
-  - *configure_git
+  - 'git config --global user.email "${GIT_CONFIG_USER_EMAIL}"'
+  - 'git config --global user.name "${GIT_CONFIG_USER_NAME}"'
 
 
 workflow: # If running on any branch other than main.
@@ -56,14 +34,6 @@ workflow: # If running on any branch other than main.
     # We are an MR, but it's a draft, we won't proceed with anything.
     - if: '$CI_MERGE_REQUEST_TITLE =~ /^wip:/i || $CI_MERGE_REQUEST_TITLE =~ /^draft:/i'
       when: never
-
-    # We have changes in the git-crypt path, we need to provision the key first before proceeding
-    - changes:
-        compare_to: $CI_DEFAULT_BRANCH
-        paths:
-          - "${GIT_CRYPT_INSTALL_PATH}/**"
-      when: always
-
     # We are a merge request
     - if: $CI_MERGE_REQUEST_IID
       variables:
@@ -84,6 +54,7 @@ workflow: # If running on any branch other than main.
         NEW_BRANCH: "staging-c3"
         VERSION: 'cat common/version.h | grep COMMA_VERSION | sed -e "s/[^0-9|.]//g"'
         EXTRA_VERSION_IDENTIFIER: "-staging"
+        AUTO_PUBLISH: true
       when: always
     # if tag
     - if: $CI_COMMIT_TAG
@@ -93,53 +64,6 @@ workflow: # If running on any branch other than main.
         EXTRA_VERSION_IDENTIFIER: "-release"
     - when: always
 
-.git-crypt privision & unlock: &git-crypt-provision-and-unlock
-  - echo "Decoding and importing GPG key..."
-  - gpg -v --import <(echo "$GPG_PRIVATE_KEY_BASE64" | base64 -d)
-  - echo "Unlocking git-crypt..."
-  - git-crypt unlock
-
-GPG key change detected:
-  stage: git-crypt-auto-provision
-  image: alpine
-  before_script:
-    - apk --update add gpg gpg-agent git-crypt git grep git-lfs openssh
-    - *configure_ci_deploy_key
-    - *configure_git
-    - *git-crypt-provision-and-unlock
-  script:
-    - echo "Checking for changes in $GIT_CRYPT_INSTALL_PATH"
-    - git fetch origin $CI_DEFAULT_BRANCH
-    - export LAST_TARGET_COMMIT_SHA=$(git rev-parse FETCH_HEAD)
-    - |
-      echo CI_COMMIT_SHA: $CI_COMMIT_SHA
-      echo GIT_CRYPT_INSTALL_PATH: $GIT_CRYPT_INSTALL_PATH
-      echo LAST_TARGET_COMMIT_SHA: $LAST_TARGET_COMMIT_SHA
-    - CHANGES=$(git diff-tree --name-only -r $LAST_TARGET_COMMIT_SHA $CI_COMMIT_SHA | grep -i "${GIT_CRYPT_INSTALL_PATH}")
-    - echo "$CHANGES"
-    - ls -la $GIT_CRYPT_KEY_PATH
-    - git-crypt unlock
-    - |
-      for key_path in $CHANGES; do
-        export key_id=$(echo $(gpg --import $key_path 2>&1) | grep -oE 'key [A-F0-9]{8,}' | awk '{print $2}')
-        git-crypt add-gpg-user --trusted $key_id
-        rm $key_path
-      done
-    - ls -la $GIT_CRYPT_KEY_PATH
-    - git-crypt lock
-    - git branch -r
-    - git fetch origin $CI_COMMIT_REF_NAME
-    - git branch -D $CI_COMMIT_REF_NAME; git checkout -b $CI_COMMIT_REF_NAME
-    - git push -u origin $CI_COMMIT_REF_NAME
-  allow_failure: false
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        compare_to: $CI_DEFAULT_BRANCH
-        paths:
-          - "${GIT_CRYPT_INSTALL_PATH}/**"
-      when: manual
-    - when: never # This ensures the job does not run if none of the above conditions are met
 
 build:
   stage: build
@@ -156,7 +80,6 @@ build:
     - "echo VERSION: ${VERSION}"
     - "echo CI_COMMIT_REF_NAME: ${CI_COMMIT_REF_NAME}"
     - git config --global --add safe.directory ${CI_PROJECT_DIR}
-    - *git-crypt-provision-and-unlock
   script:
     - export PYTHONPATH="$BUILD_DIR"
     - "echo Building Panda..."
@@ -220,11 +143,10 @@ build:
       - ${OUTPUT_DIR}/
   tags: [ 'sunnypilot', 'tici' ]
   rules:
-    - if: $NEW_BRANCH && $CI_MERGE_REQUEST_IID
+    - if: $CI_MERGE_REQUEST_IID
       when: manual
     - if: $NEW_BRANCH
       when: always
-    - when: never
 
 check no source code sent:
   image: alpine
@@ -262,7 +184,14 @@ check no source code sent:
   before_script:
     - 'apk update && apk upgrade'
     - 'apk add git bash openssh'
-    - *configure_ci_deploy_key
+    - 'eval $(ssh-agent -s)'
+    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
+    - 'mkdir -p ~/.ssh/'
+    - 'chmod 700 ~/.ssh'
+    - export HOST=$(echo ${GIT_ORIGIN} | cut -d'@' -f2 | cut -d':' -f1)
+    - echo fetching ssh pub keys for ${HOST}
+    - 'ssh-keyscan -H ${HOST} >> ~/.ssh/known_hosts' # Adding gitlab to trusted
+    - 'chmod 644 ~/.ssh/known_hosts'
     - *default_before_script
   script:
     - echo "${GIT_ORIGIN}"
@@ -287,6 +216,8 @@ publish to public github prebuilt:
     GIT_CONFIG_USER_EMAIL: "jason.wen@sunnypilot.ai"
     GIT_CONFIG_USER_NAME: "Jason Wen"
   rules:
+    - if: $AUTO_PUBLISH
+      when: on_success
     - if: $NEW_BRANCH
       when: manual
     - when: never