diff --git a/build.sh b/build.sh
index ecb0541..2fb91ec 100644
--- a/build.sh
+++ b/build.sh
@@ -24,7 +24,7 @@ VER=$(grep '"version":' "$MANIFEST_IN" | sed -re 's/.*": "(.*?)".*/\1/')
 if [ "$1" == "tag" ]; then
   echo "Tagging at $VER"
   git tag -a "$VER" -e -m"$(gitcl 2>/dev/null)"
-  git push origin "$VER"
+  git push && git push origin "$VER"
   exit 0
 fi
 if [[ "$1" =~ ^r(el(ease)?)?$ ]]; then
@@ -193,5 +193,9 @@ fi
 mv "$BUILD" "$CHROMIUM_UNPACKED"
 
 if [ "$SIGNED" ]; then
+  # ensure nscl is up-to-date git-wise
+  ./nscl_gitsync.sh
+  "$0" tag
+  nscl
   ../../we-publish "$XPI.xpi"
-fi
\ No newline at end of file
+fi
diff --git a/nscl_gitsync.sh b/nscl_gitsync.sh
new file mode 100644
index 0000000..008b185
--- /dev/null
+++ b/nscl_gitsync.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+BASE="$(dirname "$0")"
+NSCL_PATH="$BASE/src/nscl"
+commit_range=$(git diff "$NSCL_PATH" | grep 'Subproject commit' | sed -r -e's/\+.* /../' -e's/.*commit //' | tr -d '\n')
+if ! [[ $commit_range ]]; then
+  echo >&2 "nscl commits already in sync."
+  exit 1
+fi
+pushd "$NSCL_PATH"
+git log --oneline "$commit_range"
+if ! git push ; then
+  popd
+  exit 1
+fi
+popd
+git commit -m'[nscl] Updated to latest NoScript Commons Library.' "$NSCL_PATH"
+