diff --git a/taskcluster/config.yml b/taskcluster/config.yml
index 9d754aacf..b15a56b51 100644
--- a/taskcluster/config.yml
+++ b/taskcluster/config.yml
@@ -105,6 +105,11 @@ workers:
             implementation: beetmover-import-from-gcs-to-artifact-registry
             os: scriptworker
             worker-type: 'mozillavpn-{level}-beetmover'
+        shipit:
+            provisioner: scriptworker-k8s
+            implementation: scriptworker-shipit
+            os: scriptworker
+            worker-type: 'mozillavpn-{level}-shipit'
         succeed:
             provisioner: built-in
             implementation: succeed
@@ -126,3 +131,6 @@ release-promotion:
         - fetch
         - toolchain
         - toolchain-openssl
+
+shipit:
+    scope-prefix: project:mozillavpn:releng:ship-it
diff --git a/taskcluster/kinds/mark-as-shipped/kind.yml b/taskcluster/kinds/mark-as-shipped/kind.yml
new file mode 100644
index 000000000..48f53911e
--- /dev/null
+++ b/taskcluster/kinds/mark-as-shipped/kind.yml
@@ -0,0 +1,29 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.from_deps
+    - mozillavpn_taskgraph.transforms.set_name
+    - mozilla_taskgraph.transforms.scriptworker.shipit.mark_as_shipped
+    - taskgraph.transforms.task
+
+kind-dependencies:
+    - beetmover-ship
+
+tasks:
+    mark-as-shipped:
+        worker-type: shipit
+        from-deps:
+            group-by:
+                attribute: shipping-phase
+            copy-attributes: true
+            unique-kinds: false
+            set-name: false
+        shipit-product:
+            by-build-type:
+                addons/opt: mozilla-vpn-addons
+                default: mozilla-vpn-client
+        run-on-tasks-for: [action]
diff --git a/taskcluster/mozillavpn_taskgraph/transforms/set_name.py b/taskcluster/mozillavpn_taskgraph/transforms/set_name.py
new file mode 100644
index 000000000..628a9a64c
--- /dev/null
+++ b/taskcluster/mozillavpn_taskgraph/transforms/set_name.py
@@ -0,0 +1,20 @@
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.dependencies import get_primary_dependency
+
+
+transforms = TransformSequence()
+
+
+@transforms.add
+def set_name(config, tasks):
+    for task in tasks:
+        if config.kind == "mark-as-shipped":
+            dep = get_primary_dependency(config, task)
+            assert dep
+
+            product = (
+                "addons" if dep.attributes["build-type"] == "addons/opt" else "client"
+            )
+            task["name"] = f"mark-as-shipped-{product}"
+
+        yield task
diff --git a/taskcluster/requirements.txt b/taskcluster/requirements.txt
index d283b4b3e..d096ba49d 100644
--- a/taskcluster/requirements.txt
+++ b/taskcluster/requirements.txt
@@ -214,10 +214,10 @@ mozilla-repo-urls==0.1.1 \
     --hash=sha256:30510d3519479aa70211145d0ac9cf6e2fadcb8d30fa3b196bb957bd773502ba \
     --hash=sha256:7364da790751db2a060eb45adbf1d7db89a145ed279ba235f3425db9dd255915
     # via taskcluster-taskgraph
-mozilla-taskgraph==1.5.0 \
-    --hash=sha256:7399b51a0b25dc9d2617fc10aa1fca656a08b4198918f7a7d15a75c4353e45ef \
-    --hash=sha256:f472faf8705402ead88dae4f439da1d80def25eb60bfa69c4911a04f57075e34
-    # via -r requirements.in
+mozilla-taskgraph==2.0.3 \
+    --hash=sha256:4a5d1eb2682e61b2956b0bf26098acd96638a362f594110637eb5f9b43c7d93b \
+    --hash=sha256:92705caf3636afcc4e4ac45b3b80154ecad3a0ee0cb0cd209190155cd65555fa
+    # via -r taskcluster/requirements.in
 pygments==2.17.2 \
     --hash=sha256:b27c2826c47d0f3219f29554824c30c5e8945175d888647acd804ddd04af846c \
     --hash=sha256:da46cec9fd2de5be3a8a784f434e4c4ab670b4ff54d605c4c2717e9d49c4c367
@@ -311,7 +311,7 @@ taskcluster-taskgraph==7.4.0 \
     --hash=sha256:2dd814ca94d64d2663facbcb55bda18e9748ed142ef551803bba71a3e793f2ee \
     --hash=sha256:457bcf5bcef0202435cdf01b8cbc67a97fc755d647e6d5c4f4ae69f00d9e98ad
     # via
-    #   -r requirements.in
+    #   -r taskcluster/requirements.in
     #   mozilla-taskgraph
 taskcluster-urls==13.0.1 \
     --hash=sha256:5e25e7e6818e8877178b175ff43d2e6548afad72694aa125f404a7329ece0973 \