diff --git a/README.md b/README.md
index c102b84..9de80d5 100644
--- a/README.md
+++ b/README.md
@@ -7,3 +7,7 @@ onto shared webhosting.
 
 `bw test` runs according to Jenkinsfile after every commit.
 [![Build Status](https://jenkins.franzi.business/buildStatus/icon?job=kunsi%2Fbundlewrap%2Fmain)](https://jenkins.franzi.business/job/kunsi/job/bundlewrap/job/main/)
+
+## automatix
+
+Ensure you set `bundlewrap: true` in your `~/.automatix.cfg.yaml`.
diff --git a/automatix/upgrade_debian_bullseye.yaml b/automatix/upgrade_debian_bullseye.yaml
new file mode 100644
index 0000000..042752e
--- /dev/null
+++ b/automatix/upgrade_debian_bullseye.yaml
@@ -0,0 +1,48 @@
+name: Upgrade to debian bullseye
+systems:
+    node: foonode
+
+always:
+    - has_zfs=python: NODES.node.has_bundle('zfs')
+
+pipeline:
+    - manual: "set icinga2 downtime: https://icinga.kunsmann.eu/monitoring/host/schedule-downtime?host={SYSTEMS.node}"
+
+    # apply first so we only see the upgrade changes later
+    - local: bw apply {SYSTEMS.node}
+    - manual: update debian version in node groups
+    - local: "bw apply -o bundle:apt -s symlink:/usr/bin/python pkg_apt: -- {SYSTEMS.node}"
+
+    # double time!
+    - remote@node: DEBIAN_FRONTEND=noninteractive apt-get -y -q -o Dpkg::Options::=--force-confold dist-upgrade
+    - remote@node: DEBIAN_FRONTEND=noninteractive apt-get -y -q -o Dpkg::Options::=--force-confold dist-upgrade
+
+    # export zpool so we can import it later
+    - has_zfs?remote@node: zpool export tank
+
+    # reboot into bullseye
+    - remote@node: systemctl reboot
+    - local: |
+        exit=1
+        while [[ $exit -ne 0 ]];
+        do
+            sleep 1
+            ssh {SYSTEMS.node} true
+            exit=$?
+        done
+
+    # fix zfs and reboot again
+    - has_zfs?remote@node: zpool import tank
+    - has_zfs?remote@node: zpool upgrade -a
+    - has_zfs?remote@node: systemctl reboot
+    - has_zfs?local: |
+        exit=1
+        while [[ $exit -ne 0 ]];
+        do
+            sleep 1
+            ssh {SYSTEMS.node} true
+            exit=$?
+        done
+
+    # final apply
+    - local: bw apply {SYSTEMS.node}