diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..0bc66e4
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  ZIG_VERSION: "0.16.0"
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Zig
+        uses: mlugg/setup-zig@v2
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Run test suite (unit + hermetic loopback integration)
+        run: zig build test -Dintegration
+
+  cross:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Zig
+        uses: mlugg/setup-zig@v2
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Build static musl executables
+        run: zig build cross
+
+      - name: Install file(1)
+        run: |
+          if ! command -v file >/dev/null 2>&1; then
+            sudo apt-get update -qq
+            sudo apt-get install -qq -y file
+          fi
+
+      - name: Assert executables exist and are statically linked
+        run: |
+          set -euo pipefail
+          for triple in x86_64-linux-musl aarch64-linux-musl; do
+            binary="zig-out/cross/$triple/nxdns"
+            if [ ! -f "$binary" ]; then
+              echo "missing executable: $binary"
+              exit 1
+            fi
+            description=$(file -b "$binary")
+            echo "$triple: $description"
+            case "$description" in
+              *"statically linked"*) ;;
+              *)
+                echo "not statically linked: $binary"
+                exit 1
+                ;;
+            esac
+          done
diff --git a/.gitea/workflows/live-tls.yml b/.gitea/workflows/live-tls.yml
new file mode 100644
index 0000000..255cc9c
--- /dev/null
+++ b/.gitea/workflows/live-tls.yml
@@ -0,0 +1,25 @@
+name: Live TLS
+
+# Manual only. This workflow reaches public DoT resolvers, so it is
+# non-blocking by construction and never runs on push or pull_request.
+on:
+  workflow_dispatch:
+
+env:
+  ZIG_VERSION: "0.16.0"
+
+jobs:
+  live-tls:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Zig
+        uses: mlugg/setup-zig@v2
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Run full test suite including live-network tests
+        run: zig build test -Dintegration -Dlive