diff --git a/bin/forgejo_bytag.sh b/bin/forgejo_bytag.sh
new file mode 100755
index 0000000..26a08c0
--- /dev/null
+++ b/bin/forgejo_bytag.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2164,SC2181
+#
+# Download Forgejo binary by tag ID
+# - ensure output directory is writable by user running script
+#
+# Exit codes
+#  0 = success
+#  1 = curl failed to download assets
+#  2 = sha256sum check failed on download
+#  20 = not running under sudo (see FJO_SUDO)
+#  99 = improper use of script
+#
+# Requires: curl, sha256sum
+# Debug: bash -x /path/to/script.sh
+#
+# SPDX-License-Identifier: MIT
+
+_VERSION="0.0.1"
+
+# where the binary is located (e.g. "/usr/local/bin")
+FJO_DIR="/var/xyzzy/bin"
+# 0 = verbose status, 1 = silent and rely on exit codes
+FJO_QUIET=0
+# require running this script under sudo, 0 to disable
+FJO_SUDO=1
+
+# codeberg download base URL to prepend with version info
+FJO_DLB="https://codeberg.org/forgejo/forgejo/releases/download"
+# architecture being used, matches download name
+FJO_ARCH="linux-amd64"
+
+function noise() {
+  if [[ ${FJO_QUIET} -eq 0 ]]; then
+    echo "$*"
+  fi
+}
+
+if [[ ${FJO_SUDO} -eq 1 ]]; then
+  if [[ $(id -u) -ne 0 ]]; then
+    noise "Run this script as root (sudo)"
+    exit 20
+  fi
+fi
+
+# the tag name includes "v" but the downloads do not
+_FJO_TAG=""
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 <tag name>"
+  exit 99
+else
+  _FJO_TAG="${1}"
+  _FJO_NAME=${_FJO_TAG#v}
+  _FJO_NAME="forgejo-${_FJO_NAME}-${FJO_ARCH}"
+fi
+
+# disable curl download progress if in quiet mode
+_COPT=""
+if [[ ${FJO_QUIET} -eq 1 ]]; then
+  _COPT+="-s"
+fi
+
+# curl will handle a failure being able to write to output dir, etc.
+# shellcheck disable=SC2086
+noise "Attmepting to download ${_FJO_TAG} assets..."
+curl ${_COPT} -f -L --output-dir "${FJO_DIR}" --remote-name-all \
+  "${FJO_DLB}/${_FJO_TAG}/${_FJO_NAME}" \
+  "${FJO_DLB}/${_FJO_TAG}/${_FJO_NAME}.sha256"
+if [[ $? -eq 0 ]]; then
+  # downloads were successful and written to disk
+  noise "Downloads successful, checking sha256sum..."
+  pushd "$(pwd)" >/dev/null
+  cd "${FJO_DIR}" || (noise "Cannot cd to ${FJO_DIR}"; exit 5)
+  sha256sum --status -c "${_FJO_NAME}.sha256"
+  if [[ $? -eq 0 ]]; then
+    # sha256sum check passed
+    noise "Download of ${_FJO_NAME} matches sha256sum"
+  else
+    noise "Download of ${_FJO_NAME} failed sha256sum"
+    exit 2
+  fi
+  popd >/dev/null
+else
+  # curl -f exits with 22 if HTTP response is 400+
+  noise "Download of ${_FJO_NAME} and sha256 failed"
+  exit 1
+fi
+