diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..931c845
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,51 @@
+# What `make check` runs, on every push and pull request.
+name: ci
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      # The binary embeds web/dist, so nothing compiles before the frontend is built.
+      - name: frontend
+        working-directory: web
+        run: |
+          bun install --frozen-lockfile
+          bun run build
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --check
+      - run: cargo clippy --all-targets --locked -- -D warnings
+      - run: cargo test --locked
+
+  web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - working-directory: web
+        run: |
+          bun install --frozen-lockfile
+          bun run check
+
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      # Fails when a generated page is stale or a link between pages leads nowhere.
+      - run: bun scripts/wiki.ts --check
diff --git a/.github/workflows/wiki.yml b/.github/workflows/wiki.yml
new file mode 100644
index 0000000..e8131c6
--- /dev/null
+++ b/.github/workflows/wiki.yml
@@ -0,0 +1,52 @@
+# docs/wiki, published to the GitHub wiki of this repository.
+#
+# GitHub only creates a wiki's git repository once its first page exists, so
+# save any page once by hand in the Wiki tab before the first run; everything
+# in it is replaced from docs/wiki from then on.
+name: wiki
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - docs/**
+      - README.md
+      - .env.example
+      - web/src/lib/commands.ts
+      - web/src/lib/Help.svelte
+      - scripts/wiki.ts
+      - .github/workflows/wiki.yml
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: wiki
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - name: clone the wiki
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: git clone "https://x-access-token:${TOKEN}@github.com/${GITHUB_REPOSITORY}.wiki.git" wiki
+      # Generated from the code, not from what was committed, so a forgotten
+      # `make wiki` still publishes the truth.
+      - run: bun scripts/wiki.ts && bun scripts/wiki.ts --publish wiki
+      - name: push
+        working-directory: wiki
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "the wiki is already up to date"
+            exit 0
+          fi
+          git commit -m "wiki: ${GITHUB_SHA::7} $(git -C .. log -1 --format=%s)"
+          git push