diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..7d1205b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+
+      # buf-setup publishes no moving major tag, so this is pinned exactly. It resolves the
+      # download URL through the GitHub API even for a pinned buf version, and unauthenticated
+      # runners share a 60/hr limit — hence the token.
+      - uses: bufbuild/buf-setup-action@v1.50.0
+        with:
+          version: 1.73.0
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve bun cache dir
+        id: bun-cache
+        run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v6
+        with:
+          path: ${{ steps.bun-cache.outputs.dir }}
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      # The lockfile is what makes `make ci` reproducible: src/gen is committed output of the
+      # pinned protoc-gen-es, so an unpinned install fails check-codegen on a codegen drift
+      # that isn't one.
+      - run: bun install --frozen-lockfile
+
+      - run: make ci
+
+      # `bun run lint` is `biome check --write`, so formatting is fixed rather than failed.
+      - name: Check for uncommitted changes
+        run: git diff --exit-code