diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ddbe6d7
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: PHP ${{ matrix.php }}
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Floor and ceiling of the declared php constraint (>=8.1). They also cover both PHPUnit
+        # majors require-dev allows: 8.1 resolves PHPUnit 10.5, 8.4 resolves 11.5.
+        php: ['8.1', '8.4']
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer:v2
+          coverage: none
+
+      - name: Check the bundled Linux pdfinfo finds its libraries
+        # The *WithPdfinfo tests run the BUNDLED x64/linux/pdfinfo (bootstrap.php picks
+        # x64/linux on Linux). It is dynamically linked against libfontconfig.so.1, which the
+        # runner image ships today. If a future image drops it, this step fails with the loader
+        # error instead of the tests failing with an unreadable "pdfinfo failed".
+        # ldd rather than running `pdfinfo -v`: the xpdf tools exit 99 after printing their
+        # version (measured on the bundled macOS pdfinfo 4.06), so its exit code proves nothing.
+        run: |
+          ldd x64/linux/pdfinfo
+          if ldd x64/linux/pdfinfo | grep -q 'not found'; then
+            echo "::error::the bundled x64/linux/pdfinfo is missing shared libraries on this runner"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        # No composer.lock is committed (it is a library), so this resolves fresh per PHP version.
+        run: composer install --no-interaction --no-progress
+
+      - name: Run tests
+        # --fail-on-skipped: the *WithPdfinfo tests skip when pdfinfo cannot be resolved, which
+        # is right on a developer machine without it but would let CI pass green with the real
+        # binary never run. Here the bundled binary must be found, so a skip is a failure.
+        # --fail-on-empty-test-suite: a run that discovers no tests exits non-zero instead of 0.
+        run: vendor/bin/phpunit --fail-on-skipped --fail-on-empty-test-suite
+
+  lint:
+    name: Lint PHP ${{ matrix.php }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.1', '8.4']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+      - name: Syntax check every PHP file
+        run: find src tests bootstrap.php -name '*.php' -print0 | xargs -0 -n1 php -l