diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..eca744e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '27'
+          cache: maven
+
+      - name: Build and test
+        run: mvn -B -ntp verify
+
+      - name: Upload test reports
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: surefire-reports
+          path: '**/target/surefire-reports/'
diff --git a/docs/PLAN.md b/docs/PLAN.md
index 487549d..955d355 100644
--- a/docs/PLAN.md
+++ b/docs/PLAN.md
@@ -173,7 +173,7 @@ Actuator is optional; when the `pgpkeys` endpoint is exposed
 Extension points: `KeyDiscoveryCustomizer` (wraps WKD discovery below the cache) and `SecureMailSenderCustomizer`.
 
 ## Milestones
-1. **Skeleton** — parent POM, modules, CI. ✅
+1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 27). ✅
 2. **WKD discovery + cache** — `WkdKeyDiscovery`, `HttpWkdFetcher`, `CachingKeyDiscovery`, static/composite discovery,
    properties + autoconfig for discovery beans. Tests: z-base-32 vector, advanced/direct fallback matrix,
    size limit, no redirects, cache TTLs. ✅