diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..154b7e3
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'xtask/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'bundler.toml'
+      - 'check-branding.sh'
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+# Target the self-hosted Rust/audio runner registered to the `musiikki` org.
+#
+# The runner is host-mode, so the rustup toolchain installed for the
+# `gitea-runner` user is used directly — nothing installs per run, and the cargo
+# registry cache stays warm between jobs.
+#
+# Adapted from musiikki/nih-plug-template. The template gates VST3 behind an
+# opt-in `vst3` feature and so builds twice; this plugin always ships VST3
+# (nih_plug is taken with default features), so one build covers both formats.
+
+jobs:
+  build:
+    name: Build
+    runs-on: rust-audio
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Toolchain
+        run: |
+          cargo --version
+          rustc --version
+          echo "CARGO_HOME=${CARGO_HOME:?not set on this runner}"
+
+      # Cheap and needs no toolchain, so it runs first: a rename that only
+      # landed in half the files is worth catching before spending a build on it.
+      - name: Branding consistency
+        run: sh check-branding.sh
+
+      - name: Build
+        run: cargo build --release
+
+      - name: Test
+        run: cargo test --release
+
+      # Proves the xtask bundler still works, which a plain `cargo build` does
+      # not exercise — the bundle step is where bundler.toml and the crate name
+      # have to agree.
+      - name: Bundle
+        run: cargo xtask bundle codename_206 --release
diff --git a/README.md b/README.md
index 29864e6..2d1fb05 100644
--- a/README.md
+++ b/README.md
@@ -291,6 +291,23 @@ which no source licence resolves. CLAP carries neither encumbrance.
  
 ---
  
+## CI
+
+`.github/workflows/ci.yaml` gates pushes and PRs on the branding check, a release build,
+`cargo test`, and a bundle — enough to catch a rename that only half-landed, a build break,
+or a `bundler.toml` that no longer matches the crate name.
+
+It targets `runs-on: rust-audio`, a self-hosted host-mode runner registered to the `musiikki`
+org. That label is org-scoped: a fork outside `musiikki` will not see the runner and its jobs
+will queue indefinitely rather than fail.
+
+Plugin performance is deliberately not gated. Realtime cost is only meaningful against an
+audio deadline, and `Plugin::process()` cannot be called from a test at all — `ProcessContext`
+requires a `&Transport`, whose constructor and fields are `pub(crate)` to nih_plug. The DSP
+types under `src/dsp/` take no nih-plug context and are directly testable if you need it.
+
+---
+
 ## Reference Material
  
 - [NIH-plug repo](https://github.com/robbert-vdh/nih-plug) — read the `plugins/` examples first