diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..b65afa1
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,39 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: write # push the coverage badge to the `badges` branch (main only)
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: go test -race -coverprofile=cover.out ./...
+
+      # Root (Docker) action, not /action/source: the source variant compiles the
+      # tool, which needs a newer Go than go.mod pins — and fails the build.
+      - name: Coverage badge
+        uses: vladopajic/go-test-coverage@v2
+        with:
+          profile: cover.out
+          git-token: ${{ github.ref_name == 'main' && secrets.GITHUB_TOKEN || '' }}
+          git-branch: badges
diff --git a/README.md b/README.md
index 1b196df..7f58974 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,8 @@
 # pdfdisassembler
 
+[![Test](https://github.com/speedata/pdfdisassembler/actions/workflows/test.yml/badge.svg)](https://github.com/speedata/pdfdisassembler/actions/workflows/test.yml)
+[![Coverage](https://github.com/speedata/pdfdisassembler/raw/badges/.badges/main/coverage.svg)](https://github.com/speedata/pdfdisassembler/actions/workflows/test.yml)
+
 A focused, read-only PDF parser for Go. Built for tooling that **inspects**
 PDFs — accessibility checkers, validators, debuggers — without dragging in
 the writing, optimisation, signing and image-rendering machinery that