diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d79f011
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  test:
+    name: Test & coverage
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests with coverage
+        run: >
+          npx vitest run --coverage
+          --coverage.reporter=json
+          --coverage.reporter=json-summary
+          --coverage.reporter=text-summary
+          --coverage.reportOnFailure
+
+      # Posts/updates a coverage comment on PRs and writes a coverage summary
+      # to the job summary on every run (incl. pushes to main).
+      - name: Coverage report
+        if: ${{ !cancelled() }}
+        uses: davelosert/vitest-coverage-report-action@v2
diff --git a/tests/setup.ts b/tests/setup.ts
index c44951a..e8a874e 100644
--- a/tests/setup.ts
+++ b/tests/setup.ts
@@ -1 +1,9 @@
 import '@testing-library/jest-dom'
+
+// Make unit tests hermetic. The app reads VITE_SIMPLICATE_BASE_URL from
+// import.meta.env at module-load time. Locally a developer's (gitignored) .env
+// supplies it, but CI has no .env, leaving the value `undefined` and breaking
+// tests that assert a base URL was passed. Pin a deterministic fallback so the
+// suite never depends on a local .env. A real env value (if set) still wins.
+import.meta.env.VITE_SIMPLICATE_BASE_URL ??=
+  'https://test.simplicate.test/api/v2'