diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..fcf2873
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  # This is a cgo package (the libdeflate C sources are compiled at build time),
+  # so every job needs a C toolchain. ubuntu-latest ships gcc; keep cgo explicit.
+  CGO_ENABLED: "1"
+
+jobs:
+  test:
+    name: Test (Go ${{ matrix.go }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Oldest supported (go.mod minimum) and latest.
+        go: ['1.21', '1.26']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ matrix.go }}
+      - name: Build
+        run: go build ./...
+      - name: Vet
+        run: go vet ./...
+      - name: Test
+        run: go test -race -count=1 ./...
+
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: '1.26'
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.2
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..a383ea0
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,22 @@
+# golangci-lint configuration (v2 schema).
+version: "2"
+
+linters:
+  # "standard" enables errcheck, govet, ineffassign, staticcheck and unused.
+  default: standard
+  enable:
+    - misspell
+    - unconvert
+    - revive
+    - bodyclose
+    - nilerr
+  exclusions:
+    # The bundled C library under libdeflate/ contains no Go code, but exclude
+    # it explicitly so nothing here ever tries to lint it.
+    paths:
+      - libdeflate
+
+formatters:
+  enable:
+    - gofmt
+    - goimports