diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..0fe8963
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+
+# This repo had NO CI at all until 2026-09-05 -- no .gitea/workflows step ran
+# anything, so nothing was verified on push. Found by infra's task-properties
+# gate (scripts/check-task-properties.py), which asserts what CI RUNS rather
+# than what a repo contains.
+#
+# Verified before this was added, so turning verification on could not turn the
+# repo red: go build, go test and golangci-lint against the canonical
+# .golangci.yml all pass at 0 issues.
+
+on: [push]
+
+jobs:
+  check:
+    name: Lint / Test / Vet
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with: { go-version: "1.26", cache: false } # self-hosted runner: Go cache persists on disk between runs (infra#360)
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
+            | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
+          golangci-lint --version
+
+      - run: golangci-lint run ./...
+      - run: go vet ./...
+      - run: CGO_ENABLED=1 go test -race -count=1 ./...