diff --git a/.gitea/workflows/rust.yml b/.gitea/workflows/rust.yml
new file mode 100644
index 0000000..4d12864
--- /dev/null
+++ b/.gitea/workflows/rust.yml
@@ -0,0 +1,64 @@
+name: Rust (L4T)
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'scripts/check-glibc.sh'
+      - '.gitea/workflows/rust.yml'
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+# Built natively on the development Orin (runner mikkeli-orin-nano-2-yukart, host mode,
+# label l4t-rust): the car Orin's own L4T userland, so the glibc check below proves the
+# binaries load there (project-yukart docs/REPOS.md). Plain git, no JavaScript actions:
+# every yukart repo is public, and this repo needs contracts beside it (include_str!).
+
+jobs:
+  build:
+    name: Clippy, test, build, glibc
+    runs-on: l4t-rust
+    steps:
+      - name: Checkout, with contracts beside it
+        env:
+          SERVER: ${{ gitea.server_url }}
+          REPO: ${{ github.event.repository.name }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          rm -rf ws && mkdir ws
+          git clone -q --depth 1 "$SERVER/yukart/contracts.git" ws/contracts
+          git init -q "ws/$REPO"
+          git -C "ws/$REPO" fetch -q --depth 1 "$SERVER/yukart/$REPO.git" "$SHA"
+          git -C "ws/$REPO" checkout -q FETCH_HEAD
+          echo "$REPO $(git -C ws/$REPO log --oneline -1); contracts $(git -C ws/contracts log --oneline -1)"
+          rustc --version; head -1 /etc/nv_tegra_release; ldd --version | sed -n 1p
+          # Kept between runs, in the runner's own home: a cold release build is minutes on the Orin.
+          echo "CARGO_TARGET_DIR=$HOME/target/$REPO" >> "$GITHUB_ENV"
+
+      - name: Clippy
+        working-directory: ws/${{ github.event.repository.name }}
+        run: cargo clippy --release --all-targets --locked -- -D warnings
+
+      - name: Test
+        working-directory: ws/${{ github.event.repository.name }}
+        run: cargo test --release --locked
+
+      - name: Build
+        working-directory: ws/${{ github.event.repository.name }}
+        run: cargo build --release --locked
+
+      - name: glibc ceiling (the car Orin's 2.35)
+        working-directory: ws/${{ github.event.repository.name }}
+        run: |
+          set -euo pipefail
+          bins=$(cargo metadata --format-version 1 --no-deps | python3 -c '
+          import json, sys
+          for p in json.load(sys.stdin)["packages"]:
+              for t in p["targets"]:
+                  if "bin" in t["kind"]: print(t["name"])')
+          for b in $bins; do scripts/check-glibc.sh "$CARGO_TARGET_DIR/release/$b"; done