diff --git a/debian/changelog b/debian/changelog
index fce6b6c7f960c015adf6ef4699889c1c447fde66..4ab65fbd3e51f030779b63990a3668b1ef866027 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+apertis-dev-tools (0.2021.9) apertis; urgency=medium
+
+  * apertis-pkg-merge-updates: fast-forward the main debian branch
+      after a Debian release point
+
+ -- Dylan Aïssi <dylan.aissi@collabora.com>  Fri, 13 May 2022 14:33:34 +0200
+
 apertis-dev-tools (0.2021.8) apertis; urgency=medium
 
   * Add a script to switch between coreutils and rust-coreutils
diff --git a/tools/apertis-pkg-pull-updates b/tools/apertis-pkg-pull-updates
index ce5b4afc90d3b268a93fb002679044da35ec8b26..9c01de3775d0532d8ae27d24738478b126ecdd13 100755
--- a/tools/apertis-pkg-pull-updates
+++ b/tools/apertis-pkg-pull-updates
@@ -21,6 +21,7 @@ import yaml
 
 from sh.contrib import git
 from itertools import chain
+from functools import cache
 
 from debian.debian_support import Version
 from debian.changelog import Changelog
@@ -82,6 +83,7 @@ def prepare_git_repo(upstream_suite):
   ensure_suite_branches(f'{upstream_suite}-proposed-updates', allow_missing=True)
   configure_git_user('Apertis CI', 'devel@lists.apertis.org')
 
+@cache
 def get_remote_version(suite, package):
     """Request the package version for the Debian suite from Madison
 
@@ -259,7 +261,7 @@ def main():
   print('source package', package_name)
   prepare_git_repo(upstream_suite)
   for suite in [f'{upstream_suite}-security', f'{upstream_suite}-proposed-updates', upstream_suite]:
-      _, local_version = get_newest_branch_version(upstream_suite)
+      local_version_branch, local_version = get_newest_branch_version(upstream_suite)
       print('local version:', local_version)
       remote_version = should_update(suite, package_name, local_version, upstream_suite==suite)
       if remote_version:
@@ -273,5 +275,21 @@ def main():
             if (local_version.upstream_version != remote_version.upstream_version) and (remote_version.debian_revision is not None):
                 run(['pristine-lfs', 'import-dsc', local_dsc])
 
+      # Keep the debian/{suite} (e.g. debian/bullseye) branches up-to-date after a point release.
+      # i.e. Updates from {upstream_suite}-security and {upstream_suite}-proposed-updates fall into
+      # the main repo {upstream_suite}. We need to sync the corresponding branch with the one used previously.
+      if suite == upstream_suite:
+          local_suite_version = Version(get_git_branch_version(debian_branch(upstream_suite)))
+          remote_suite_version = should_update(upstream_suite, package_name, local_suite_version)
+          if remote_suite_version and remote_suite_version == local_version:
+            upstream_suite_branch = debian_branch(upstream_suite)
+            print(upstream_suite_branch, 'needs a fast-forward from', local_version_branch, 'for', remote_suite_version)
+            git('checkout', upstream_suite_branch)
+            o = git('merge', '--ff-only', local_version_branch, _out='/dev/stdout', _err='/dev/stderr')
+            if o.exit_code == 0:
+              print(f"⏩ Successfully fast-forwarded {local_version_branch} to {upstream_suite_branch}")
+            else:
+              print('🛑 Fast-forward failed')
+
 if __name__ == '__main__':
   main()