diff --git a/Makefile b/Makefile
index 1553f76..b7da4c0 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ STEPS=		arm base boot chroot clean core distfiles dvd info \
 		kernel nano plugins ports prefetch print rebase \
 		release rename serial sign skim test update verify \
 		vga vm xtools
-SCRIPTS=	batch nightly pkg_fingerprint pkg_sign
+SCRIPTS=	batch nightly refresh pkg_fingerprint pkg_sign
 .PHONY:		${STEPS}
 
 PAGER?=		less
diff --git a/README.md b/README.md
index 3fc6a52..ec87b04 100644
--- a/README.md
+++ b/README.md
@@ -376,10 +376,17 @@ and LibreSSL packages are both required they can be batch-built using:
 
     # make batch-<step>[,<option>[,...]]
 
-Last but not least, a fully contained nightly build for the system
-is invoked using:
+A fully contained nightly build for the system is invoked using:
 
     # make nightly
 
 Nightly builds are the only builds that write and archive logs under
 /tmp/logs and /tmp/logs/latest points to the last nightly build run.
+
+Last but not least, a refresh of OPNsense core and plugins on package
+sets is invoked using:
+
+    # make refresh
+
+It will flush all previous packages except for ports, rebuild core and
+plugins and sign the sets if enabled.  It is used to issue hotfixes.
diff --git a/scripts/refresh.sh b/scripts/refresh.sh
new file mode 100755
index 0000000..60fc012
--- /dev/null
+++ b/scripts/refresh.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+# refresh plugins and core in packages
+
+for FLAVOUR in OpenSSL LibreSSL; do
+	make clean-obj,plugins,core packages FLAVOUR=${FLAVOUR}
+done
+
+make clean-obj