diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..7820da2
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+    branches: [master, develop]
+
+jobs:
+  lint-and-test:
+    name: Lint, type check, unit tests, coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - name: Install frontend dependencies
+        run: npm ci
+        working-directory: frontend
+
+      - name: Lint
+        run: npm run lint
+        working-directory: frontend
+
+      - name: Type check
+        run: npx vue-tsc --noEmit
+        working-directory: frontend
+
+      - name: Frontend unit tests
+        run: npm run test
+        working-directory: frontend
+
+      - name: Backend unit tests
+        run: ./gradlew :backend:test
+
+      - name: Coverage verification
+        run: |
+          ./gradlew :backend:jacocoTestCoverageVerification
+          npm run test:coverage
+        working-directory: frontend
+
+  e2e:
+    name: E2E browser tests
+    runs-on: ubuntu-latest
+    env:
+      POSTGRES_DB: bilhej
+      POSTGRES_USER: bilhej
+      POSTGRES_PASSWORD: test_pw_ci_123
+      JWT_SECRET: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+      STRIPE_SECRET_KEY: sk_test_fake
+      STRIPE_WEBHOOK_SECRET: whsec_fake
+      STRIPE_PRICE_ID: price_fake
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run E2E test stack
+        run: |
+          docker compose \
+            -f docker-compose.ci.yml \
+            up --build --abort-on-container-exit --exit-code-from playwright