diff --git a/contrib/colmena-wrapper.nix b/contrib/colmena-wrapper.nix
new file mode 100644
index 00000000..dba5c08a
--- /dev/null
+++ b/contrib/colmena-wrapper.nix
@@ -0,0 +1,18 @@
+# A wrapper for colmena that prevents accidentally deploying changes without
+# having pulled.
+{ colmena, runCommandNoCC }:
+runCommandNoCC "colmena-wrapper"
+{
+  env = {
+    colmena = "${colmena}/bin/colmena";
+    remote_name = "origin";
+    upstream_branch = "main";
+  };
+} ''
+  mkdir -p $out
+  ln -s ${colmena}/share $out/share
+  mkdir $out/bin
+
+  substituteAll ${./colmena-wrapper.sh.in} $out/bin/colmena
+  chmod +x $out/bin/colmena
+''
diff --git a/contrib/colmena-wrapper.sh.in b/contrib/colmena-wrapper.sh.in
new file mode 100755
index 00000000..db6f4b01
--- /dev/null
+++ b/contrib/colmena-wrapper.sh.in
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+doChecks() {
+    # creates refs in the refs/prefetch/remotes/origin namespace
+    echo "Prefetching repo changes..." >&2
+    git fetch --quiet --prefetch --no-write-fetch-head @remote_name@
+
+    diffs=$(git rev-list --left-right --count HEAD...refs/prefetch/remotes/@remote_name@/@upstream_branch@)
+    only_in_local=$(echo "$diffs" | cut -f1)
+    only_in_main=$(echo "$diffs" | cut -f2)
+
+    if [[ $only_in_main -gt 0 && ! -v $FOOTGUN_ME_UWU ]]; then
+        echo >&2
+        echo "Attempting to deploy when @upstream_branch@ has $only_in_main commits not in your branch!" >&2
+        echo "This will probably revert someone's changes. Consider merging them." >&2
+        echo "If you really mean it, set the environment variable FOOTGUN_ME_UWU" >&2
+        exit 1
+    fi
+
+    if [[ $only_in_local -gt 0 ]]; then
+        echo "You have $only_in_local commits not yet pushed to @upstream_branch@. Reminder to push them after :)" >&2
+    fi
+}
+
+if [[ $1 == 'apply' ]]; then
+    doChecks
+fi
+
+exec @colmena@ "$@"