diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..0d86bcb
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+
+jobs:
+    check:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+            # tsdown requires ^22.18.0 || >=24.11.0
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              with:
+                  node-version: 24
+                  cache: npm
+
+            - run: npm ci
+
+            - run: npm run typecheck
+
+            - run: npm run build
+
+            - run: npm test
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..e4dced1
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,44 @@
+name: Publish
+
+on:
+    release:
+        types: [published]
+
+jobs:
+    publish:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            # Required for npm provenance
+            id-token: write
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+            # tsdown requires ^22.18.0 || >=24.11.0
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              with:
+                  node-version: 24
+                  cache: npm
+                  registry-url: https://registry.npmjs.org
+
+            - run: npm ci
+
+            - run: npm run typecheck
+
+            - run: npm test
+
+            # Take the version from the release tag (strip a leading "v").
+            # --allow-same-version: npm errors on a no-op version change,
+            # which would fail releases whose tag matches package.json.
+            - name: Set version from release tag
+              run: npm version --no-git-tag-version --allow-same-version "${TAG#v}"
+              env:
+                  TAG: ${{ github.event.release.tag_name }}
+
+            # Auth is via npm trusted publishing (OIDC, requires the
+            # id-token permission above) — no token secret. prepublishOnly
+            # runs the build. GitHub prereleases go to the "next" dist-tag
+            # so they never become npm's "latest".
+            - run: npm publish --provenance --tag "${DIST_TAG}"
+              env:
+                  DIST_TAG: ${{ github.event.release.prerelease && 'next' || 'latest' }}