diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..6cd636a
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'xtask/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'bundler.toml'
+      - 'check-branding.sh'
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+# Target the self-hosted Rust/audio runner registered to the `musiikki` org.
+#
+# The runner is host-mode, so the rustup toolchain installed for the
+# `gitea-runner` user is used directly — nothing installs per run, and the cargo
+# registry cache stays warm between jobs.
+#
+# NOTE: `rust-audio` is an ORG-SCOPED label. A plugin cloned from this template
+# into a different org will not see that runner, and its jobs will queue
+# indefinitely rather than fail. Either register a runner advertising this label
+# for that org, or change `runs-on` below.
+
+jobs:
+  build:
+    name: Build
+    runs-on: rust-audio
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Toolchain
+        run: |
+          cargo --version
+          rustc --version
+          echo "CARGO_HOME=${CARGO_HOME:?not set on this runner}"
+
+      # Cheap and needs no toolchain, so it runs first: a rename that only
+      # landed in half the files is worth catching before spending a build on it.
+      - name: Branding consistency
+        run: sh check-branding.sh
+
+      # The default build is CLAP-only; the vst3 feature is opt-in, so both
+      # configurations have to be built to know the cfg gates are still correct.
+      - name: Build (default, CLAP only)
+        run: cargo build --release
+
+      - name: Build (--features vst3)
+        run: cargo build --release --features vst3
+
+      - name: Test
+        run: cargo test --release --features vst3
+
+      # Proves the xtask bundler still works, which a plain `cargo build` does
+      # not exercise — the bundle step is where bundler.toml and the crate name
+      # have to agree.
+      - name: Bundle
+        run: cargo xtask bundle nih_plug_template --release --features vst3
diff --git a/README.md b/README.md
index 0d82bee..a325e6e 100644
--- a/README.md
+++ b/README.md
@@ -107,8 +107,25 @@ xtask/              # Bundler xtask (cargo xtask bundle)
 .cargo/config.toml  # xtask alias
 check-branding.sh   # Asserts the plugin's identity strings agree everywhere (see Renaming)
 .gitattributes      # Pins *.sh to LF so Windows checkouts keep a valid shebang
+.github/workflows/  # CI: branding check, both feature sets build, test, bundle
 ```
 
+## CI
+
+`.github/workflows/ci.yaml` gates pushes and PRs on the branding check, a build of both
+feature sets, `cargo test`, and a bundle — enough to catch a rename that only half-landed,
+a `cfg(feature = "vst3")` gate that stopped compiling, or a `bundler.toml` that no longer
+matches the crate name.
+
+It targets `runs-on: rust-audio`, an **org-scoped** runner label. A plugin cloned into a
+different org will not see that runner and its jobs will queue indefinitely rather than fail
+— register a runner advertising the label for that org, or change `runs-on`.
+
+Deliberately not covered: plugin performance. Realtime cost can only be measured meaningfully
+against a real audio deadline, and `Plugin::process()` cannot be called from a test at all
+(`ProcessContext` requires a `Transport`, whose constructor and fields are `pub(crate)` to
+nih-plug). Benchmark your DSP types directly if you need it.
+
 ## License
 
 **GPL-3.0-or-later.** See `LICENSE` for the terms and `NOTICE` for third-party attribution.