diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c91ded2
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,29 @@
+---
+name: CI
+
+"on":
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Sync dependencies
+        run: uv sync --locked
+
+      - name: Run unit tests
+        run: uv run python -m unittest discover -s tests
diff --git a/tests/test_compose_contract.py b/tests/test_compose_contract.py
index eb55591..dcaeccf 100644
--- a/tests/test_compose_contract.py
+++ b/tests/test_compose_contract.py
@@ -15,7 +15,10 @@ def test_base_compose_file_is_pull_only_for_web(self) -> None:
 
     def test_override_compose_file_owns_local_web_build(self) -> None:
         repo_root = Path(__file__).resolve().parent.parent
-        override_compose_text = (repo_root / "docker-compose.override.yml").read_text(encoding="utf-8")
+        override_compose_path = repo_root / "docker-compose.override.yml"
+        if not override_compose_path.exists():
+            self.skipTest("Local docker-compose.override.yml is optional and not tracked in clean repo checkouts")
+        override_compose_text = override_compose_path.read_text(encoding="utf-8")
 
         self.assertIn("  web:\n    <<: *common\n    build:\n", override_compose_text)
         self.assertIn("      dockerfile: docker/Dockerfile\n", override_compose_text)