diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..d513071
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,66 @@
+# CI: every pull request and every push to main must pass these checks
+# (ADR 0014). The deploy pipeline (CD) lives in cd.yml and only runs on
+# main after this workflow's quality bar.
+#
+# Runner requirements: an act_runner with the `ubuntu-latest` label and
+# Docker access (see deploy/stages.md, issue #9).
+
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    name: Lint, typecheck, test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Build first: package type checks resolve @dorfteich/shared through
+      # its built dist, and i18n:check imports the built helpers.
+      - name: Build all packages
+        run: pnpm build
+
+      - name: Lint (ESLint + Prettier)
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Unit and integration tests
+        run: pnpm test
+
+      - name: Translation key parity (de/en)
+        run: pnpm i18n:check
+
+  images:
+    name: Build container images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      # PRs prove the Dockerfiles still build; pushing happens in cd.yml.
+      - name: Build web image
+        run: docker build -f apps/web/Dockerfile --build-arg APP_VERSION=${{ github.sha }} -t dorfteich-web:ci .
+
+      - name: Build api image
+        run: docker build -f apps/api/Dockerfile --build-arg APP_VERSION=${{ github.sha }} -t dorfteich-api:ci .