diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..176a406
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,49 @@
+# `mise run check` on every pull request and every push to main: what docs/development.md says
+# must pass before a change is done. Tests that need docker or a browser (`test:docker`,
+# `go:test-integration`, `console:e2e`, `deploy:smoke`) are not run here.
+name: check
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # `proto:breaking` compares against the local `main` branch.
+          fetch-depth: 0
+
+      - name: Local main branch for buf breaking
+        run: git show-ref --verify --quiet refs/heads/main || git branch main origin/main
+
+      # Installs every tool mise.toml pins, cached by its hash.
+      - uses: jdx/mise-action@v5
+
+      - uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cache/uv
+            ~/go/pkg/mod
+            ~/.cache/go-build
+            ~/.cache/golangci-lint
+            ~/.local/share/pnpm/store
+          key: deps-${{ runner.os }}-${{ hashFiles('uv.lock', 'go/go.sum', 'console/pnpm-lock.yaml', 'mise.toml') }}
+          restore-keys: deps-${{ runner.os }}-
+
+      - name: Sync Python dependencies
+        run: mise run sync
+
+      - name: mise run check
+        run: mise run check
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 43ce97a..819a981 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,8 @@
   before.
 
 ### Added
+- CI: `mise run check` on every pull request and push to `main`
+  (`.github/workflows/check.yml`).
 - The control plane asks model-gateway which models it serves (`swarmeval-control
   --gateway-http`) and refuses a submission or fork naming another, before anything is stored;
   model-gateway out of reach is `UNAVAILABLE`. `ControlService.ListModels` lists them.
diff --git a/docs/development.md b/docs/development.md
index aef087e..aad855a 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -45,6 +45,13 @@ mise run sync
 | `mise run proto:lint:console` | The same check for the console's generated client |
 | `mise run proto:breaking` | `buf breaking` against the local `main` branch. Only the public API, `proto/swarmeval/api/`, is checked; `buf.yaml` lists the internal packages it ignores, and a new internal package goes on that list |
 
+## CI
+
+[`.github/workflows/check.yml`](../.github/workflows/check.yml) runs `mise run check` on every
+pull request and every push to `main`, with the tools `mise.toml` pins. The tasks that need
+docker or a browser (`test:docker`, `go:test-integration`, `console:e2e`, `deploy:smoke`) are
+not part of it: run the ones the "Run it before…" notes above name for your change yourself.
+
 ## Running a case
 
 Every service on one machine, against a real model. Nothing here is needed for `mise run check`.