diff --git a/infra/workers/data-puller/package.json b/infra/workers/data-puller/package.json
new file mode 100644
index 0000000000..183b2b6bf1
--- /dev/null
+++ b/infra/workers/data-puller/package.json
@@ -0,0 +1,5 @@
+{
+    "name": "data-puller",
+    "version": "0.0.0",
+    "private": true
+}
diff --git a/infra/workers/data-puller/src/index.ts b/infra/workers/data-puller/src/index.ts
new file mode 100644
index 0000000000..38cdad000d
--- /dev/null
+++ b/infra/workers/data-puller/src/index.ts
@@ -0,0 +1,30 @@
+/**
+ * Proxy requests for downloading files from object storage.
+ *
+ * Used by museum when replicating.
+ */
+
+export default {
+    async fetch(request: Request) {
+        switch (request.method) {
+            case "GET":
+                return handleGET(request);
+            default:
+                console.log(`Unsupported HTTP method ${request.method}`);
+                return new Response(null, { status: 405 });
+        }
+    },
+} satisfies ExportedHandler;
+
+const handleGET = async (request: Request) => {
+    const url = new URL(request.url);
+
+    // Random bots keep trying to pentest causing noise in the logs. If the
+    // request doesn't have a src, we can just safely ignore it.
+    const src = url.searchParams.get("src");
+    if (!src) return new Response(null, { status: 400 });
+
+    const source = atob(src);
+
+    return fetch(source);
+};
diff --git a/infra/workers/data-puller/tsconfig.json b/infra/workers/data-puller/tsconfig.json
new file mode 100644
index 0000000000..a65b752070
--- /dev/null
+++ b/infra/workers/data-puller/tsconfig.json
@@ -0,0 +1 @@
+{ "extends": "../tsconfig.base.json", "include": ["src"] }
diff --git a/infra/workers/data-puller/wrangler.toml b/infra/workers/data-puller/wrangler.toml
new file mode 100644
index 0000000000..7c254ec480
--- /dev/null
+++ b/infra/workers/data-puller/wrangler.toml
@@ -0,0 +1,5 @@
+name = "data-puller"
+main = "src/index.ts"
+compatibility_date = "2024-06-14"
+
+tail_consumers = [{ service = "tail" }]