diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..f8f0087
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://github.com/astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync
+      - run: uv run pytest web/tests/ -x -q -p no:faulthandler
+      - run: uv run ruff check web/src/ web/tests/
+
+  # Creates v<N> tag after tests pass. The on-server supervisor polls for new
+  # tags every 60s and deploys automatically. No SSH keys or deploy credentials
+  # needed in CI — only the built-in github.token.
+  tag:
+    needs: [test]
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ github.token }}
+      - name: Create and push tag
+        run: |
+          git config user.name "CI"
+          git config user.email "ci@noreply"
+          git tag "v${{ github.run_number }}"
+          git push origin "v${{ github.run_number }}"