diff --git a/.github/workflows/mirror.yml b/.github/workflows/envoy-sync.yaml
similarity index 75%
rename from .github/workflows/mirror.yml
rename to .github/workflows/envoy-sync.yaml
index 3cad16f7..8b04690a 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/envoy-sync.yaml
@@ -21,18 +21,23 @@ jobs:
           || github.actor == 'sync-envoy[bot]'
       }}
     steps:
-    # Checkout the repo at provided commit
+    # Checkout the repo
     - name: 'Checkout Repository'
       uses: actions/checkout@v3
+      with:
+        ref: main
+        fetch-depth: 0
 
-    # Checkout the Envoy repo at latest commit
+    # Checkout the Envoy repo
     - name: 'Checkout Repository'
       uses: actions/checkout@v3
       with:
         repository: envoyproxy/envoy
+        ref: main
         fetch-depth: 0
         path: upstream
 
     - run: mv upstream ../envoy
-    - run: ci/mirror.sh
-      working-directory: ../envoy
+    - run: ci/sync_envoy.sh
+      env:
+        ENVOY_SRC_DIR: ../envoy
diff --git a/ci/mirror.sh b/ci/mirror.sh
deleted file mode 100755
index 20628510..00000000
--- a/ci/mirror.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-set -e
-
-CHECKOUT_DIR=../data-plane-api
-API_MAIN_BRANCH="main"
-
-# Determine last envoyproxy/envoy SHA in envoyproxy/data-plane-api
-MIRROR_MSG="Mirrored from https://github.com/envoyproxy/envoy"
-LAST_ENVOY_SHA=$(git -C "$CHECKOUT_DIR" log --grep="$MIRROR_MSG" -n 1 | grep "$MIRROR_MSG" | \
-  tail -n 1 | sed -e "s#.*$MIRROR_MSG @ ##")
-
-echo "Last mirrored envoyproxy/envoy SHA is $LAST_ENVOY_SHA"
-
-# Compute SHA sequence to replay in envoyproxy/data-plane-api
-SHAS=$(git rev-list --reverse "$LAST_ENVOY_SHA"..HEAD api/)
-
-# For each SHA, hard reset, rsync api/ and generate commit in
-# envoyproxy/data-plane-api
-API_WORKING_DIR="../envoy-api-mirror"
-git worktree add "$API_WORKING_DIR"
-for sha in $SHAS; do
-    echo "Adding commit ${sha}"
-    git -C "$API_WORKING_DIR" reset --hard "$sha"
-    COMMIT_MSG=$(git -C "$API_WORKING_DIR" log --format=%B -n 1)
-    QUALIFIED_COMMIT_MSG=$(echo -e "$COMMIT_MSG\n\n$MIRROR_MSG @ $sha")
-    rsync -acv --delete --exclude "ci/" --exclude ".*" --exclude LICENSE \
-          "$API_WORKING_DIR"/api/ "$CHECKOUT_DIR"/
-    git -C "$CHECKOUT_DIR" add .
-    git -C "$CHECKOUT_DIR" commit -m "$QUALIFIED_COMMIT_MSG"
-done
-
-if [[ -n "$SHAS" ]]; then
-    echo "Pushing..."
-    git -C "$CHECKOUT_DIR" push origin "${API_MAIN_BRANCH}"
-else
-    echo "Nothing to push"
-fi
-echo "Done"
diff --git a/ci/sync_envoy.sh b/ci/sync_envoy.sh
new file mode 100755
index 00000000..ecbfa24d
--- /dev/null
+++ b/ci/sync_envoy.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -e
+
+API_MAIN_BRANCH="main"
+
+if [[ -z "$ENVOY_SRC_DIR" ]]; then
+    echo "ENVOY_SRC_DIR not set, it should point to a cloned Envoy repo" >&2
+    exit 1
+elif [[ ! -e "$ENVOY_SRC_DIR" ]]; then
+    echo "ENVOY_SRC_DIR ($ENVOY_SRC_DIR) not found, did you clone it?" >&2
+    exit 1
+fi
+
+
+# Determine last envoyproxy/envoy SHA in envoyproxy/data-plane-api
+MIRROR_MSG="Mirrored from https://github.com/envoyproxy/envoy"
+LAST_ENVOY_SHA="$(git log --grep="$MIRROR_MSG" -n 1 | grep "$MIRROR_MSG" \
+                      | tail -n 1 \
+                      | sed -e "s#.*$MIRROR_MSG @ ##")"
+
+echo "Last mirrored envoyproxy/envoy SHA is $LAST_ENVOY_SHA"
+
+# Compute SHA sequence to replay in envoyproxy/data-plane-api
+SHAS=$(git -C "$ENVOY_SRC_DIR" rev-list --reverse "$LAST_ENVOY_SHA"..HEAD api/)
+
+read -r -a SHAS <<< "$(git -C "$ENVOY_SRC_DIR" rev-list --reverse "$LAST_ENVOY_SHA"..HEAD api/ | tr '\n' ' ')"
+
+# For each SHA, hard reset, rsync api/ and generate commit in
+# envoyproxy/data-plane-api
+API_WORKING_DIR="../envoy-api-mirror"
+git -C "$ENVOY_SRC_DIR" worktree add "$API_WORKING_DIR"
+for sha in "${SHAS[@]}"; do
+    echo "Adding commit ${sha}"
+    git -C "$API_WORKING_DIR" reset --hard "$sha"
+    COMMIT_MSG="$(git -C "$API_WORKING_DIR" log --format=%B -n 1)"
+    QUALIFIED_COMMIT_MSG="$(echo -e "$COMMIT_MSG\n\n$MIRROR_MSG @ $sha")"
+    rsync -acv --delete --exclude "ci/" --exclude ".*" --exclude LICENSE \
+          "${API_WORKING_DIR}/api/" .
+    git add .
+    git commit -m "$QUALIFIED_COMMIT_MSG"
+done
+
+if [[ "${#SHAS[@]}" -ne 0 ]; then
+    echo "Pushing..."
+    git push origin "${API_MAIN_BRANCH}"
+else
+    echo "Nothing to push"
+fi
+echo "Done"