diff --git a/.github/workflows/sync-fork.yml b/.github/workflows/sync-fork.yml
new file mode 100644
index 0000000000..24693c794e
--- /dev/null
+++ b/.github/workflows/sync-fork.yml
@@ -0,0 +1,19 @@
+name: Sync Fork
+
+on:
+  schedule:
+    - cron: '*/60 * * * *' # run hourly
+  workflow_dispatch: # or run on button click
+
+jobs:
+  sync:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: tgymnich/fork-sync@v1.8
+        with:
+          token: ${{ secrets.SYNC_FORK_TOKEN }}
+          owner: microsoft
+          base: main
+          head: main
diff --git a/.gitignore b/.gitignore
index 2f4cff580f..6fd1293a29 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,4 +19,7 @@ lcov.info
 /src/ApiService/ApiService/Properties/PublishProfiles/*
 /src/ApiService/ApiService/Properties/ServiceDependencies/*
 
-.vs
\ No newline at end of file
+.vs
+
+# Local fork tools, not to be merged back into main repo
+/.github/workflows/sync-fork.yml
diff --git a/src/agent/Cargo.lock b/src/agent/Cargo.lock
index d6b082bf2c..86ff547871 100644
--- a/src/agent/Cargo.lock
+++ b/src/agent/Cargo.lock
@@ -232,9 +232,9 @@ dependencies = [
 
 [[package]]
 name = "base64"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64"
@@ -1291,7 +1291,7 @@ checksum = "6e9b187a72d63adbfba487f48095306ac823049cb504ee195541e91c7775f5ad"
 dependencies = [
  "anyhow",
  "async-channel",
- "base64 0.13.0",
+ "base64 0.13.1",
  "futures-lite",
  "http",
  "infer",
@@ -1976,7 +1976,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "backoff",
- "base64 0.13.0",
+ "base64 0.21.0",
  "bytes",
  "clap",
  "cpp_demangle",
@@ -2689,7 +2689,7 @@ version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "87f242f1488a539a79bac6dbe7c8609ae43b7914b7736210f239a37cccb32525"
 dependencies = [
- "base64 0.13.0",
+ "base64 0.13.1",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -3111,7 +3111,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "backoff",
- "base64 0.13.0",
+ "base64 0.21.0",
  "bincode",
  "bytes",
  "derivative",
diff --git a/src/agent/onefuzz/Cargo.toml b/src/agent/onefuzz/Cargo.toml
index cecc6e37ef..ba26803c54 100644
--- a/src/agent/onefuzz/Cargo.toml
+++ b/src/agent/onefuzz/Cargo.toml
@@ -9,7 +9,7 @@ license = "MIT"
 [dependencies]
 anyhow = "1.0"
 async-trait = "0.1"
-base64 = "0.13"
+base64 = "0.21"
 bytes = "1.4"
 dunce = "1.0"
 dynamic-library = { path = "../dynamic-library" }
diff --git a/src/agent/storage-queue/Cargo.toml b/src/agent/storage-queue/Cargo.toml
index 00a41fa892..3de60598ca 100644
--- a/src/agent/storage-queue/Cargo.toml
+++ b/src/agent/storage-queue/Cargo.toml
@@ -9,7 +9,7 @@ license = "MIT"
 anyhow = "1.0"
 async-trait = "0.1"
 backoff = { version = "0.4", features = ["tokio"] }
-base64 = "0.13"
+base64 = "0.21"
 bytes = { version = "1.4", features = ["serde"] }
 derivative = "2.2"
 flume = "0.10"