diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..d23d851
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,24 @@
+name: Tests
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: vet + fmt + tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Latest supported Go
+        run: docker compose run --rm ci
+      - name: Lowest supported Go
+        env:
+          GO_VERSION: 1.22.12
+        run: docker compose run --rm ci
diff --git a/README.md b/README.md
index eeaacdb..e2b75cd 100644
--- a/README.md
+++ b/README.md
@@ -399,14 +399,16 @@ docker compose run --rm --user "$(id -u):$(id -g)" fmt   # gofmt -w .
 docker compose run --rm --user "$(id -u):$(id -g)" tidy  # go mod tidy
 ```
 
-`docker build .` runs `go vet` and the tests, so it works as a CI gate too.
+Every pull request runs `docker compose run --rm ci` against both the latest and
+the lowest supported Go, and must pass before it can be merged. `docker build .`
+runs the same vet and tests locally.
 
 Tests run against the latest Go by default. Set `GO_VERSION` to check the lowest
 supported version too:
 
 ```sh
-GO_VERSION=1.22 docker compose run --rm test   # lowest supported
-docker compose run --rm test                   # latest
+GO_VERSION=1.22.12 docker compose run --rm test   # lowest supported
+docker compose run --rm test                      # latest
 ```
 
 ## Layout