diff --git a/.github/workflows/ci-stu3.yml b/.github/workflows/ci-stu3.yml
new file mode 100644
index 0000000..8ccb85b
--- /dev/null
+++ b/.github/workflows/ci-stu3.yml
@@ -0,0 +1,71 @@
+name: CI STU3
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+  pull_request:
+
+jobs:
+  build:
+    if: github.repository == 'incendilabs/plan-executor'
+
+    runs-on: ubuntu-24.04
+    steps:
+      -
+        name: Checkout repo
+        uses: actions/checkout@v4
+      -
+        name: Build docker image
+        run: docker build -t incendi/plan_executor:latest .
+      -
+        name: Run tests
+        run: |
+          mkdir -p logs html_summaries json_results
+          docker compose -f docker-compose-stu3.yml up -d spark
+          docker compose run --rm --no-deps plan_executor ./execute_all.sh 'http://spark:8080/fhir' stu3 'html|json|stdout'
+          docker compose logs spark > logs/backend.log
+      -
+        name: Combine test results
+        if: ${{ always() }}
+        run: ./combine-test-results.sh json_results annotations.json
+      -
+        name: Attach test results
+        if: github.event_name != 'pull_request'
+        uses: yuzutech/annotations-action@v0.5.0
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          input: annotations.json
+      -
+        name: Archive logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: logs-r4-${{ github.sha }}
+          path: logs/*.log*
+      -
+        name: Archive test reports
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: html_summaries-r4-${{ github.sha }}
+          path: html_summaries/**/*.html
+      -
+        name: Archive JSON results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: json_results-r4-${{ github.sha }}
+          path: json_results/**/*.json
+      -
+        name: Archive annotations file
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: annotations-r4-${{ github.sha }}
+          path: annotations.json
+      -
+        name: Cleanup
+        if: ${{ always() }}
+        run: docker compose down
\ No newline at end of file
diff --git a/docker-compose-stu3.yml b/docker-compose-stu3.yml
new file mode 100644
index 0000000..3c290e5
--- /dev/null
+++ b/docker-compose-stu3.yml
@@ -0,0 +1,32 @@
+services:
+  spark:
+    container_name: spark
+    restart: always
+    image: sparkfhir/spark:stu3-latest
+    environment:
+      - StoreSettings__ConnectionString=mongodb://root:secret@mongodb:27017/spark?authSource=admin
+      - SparkSettings__Endpoint=http://spark:8080/fhir
+      - ASPNETCORE_URLS=http://+:8080
+      - ASPNETCORE_HTTP_PORT=8080
+    ports:
+      - "8000:8080"
+      - "8001:8081"
+    depends_on:
+      - mongodb
+  mongodb:
+    container_name: mongodb
+    image: sparkfhir/mongo:stu3-latest
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: root
+      MONGO_INITDB_ROOT_PASSWORD: secret
+    ports:
+      - "17017:27017"
+  plan_executor:
+    container_name: plan_executor
+    image: incendi/plan_executor:latest
+    depends_on:
+      - spark
+    volumes:
+      - ./logs:/app/logs:rw
+      - ./html_summaries:/app/html_summaries:rw
+      - ./json_results:/app/json_results:rw