diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..9e549e6
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,58 @@
+default:
+  image: rust:1.97
+  cache:
+    key:
+      files:
+        - Cargo.lock
+    paths:
+      - .cargo/registry
+      # so the audit job does not rebuild cargo-audit on every schedule
+      - .cargo/bin
+      - target
+
+variables:
+  # keep the registry inside the project so it lands in the cache
+  CARGO_HOME: $CI_PROJECT_DIR/.cargo
+  CARGO_TERM_COLOR: always
+
+# without this a push to a branch with an open merge request runs twice
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
+      when: never
+    - if: $CI_COMMIT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+
+check:
+  script:
+    - rustup component add rustfmt clippy
+    - cargo fmt --check
+    - cargo clippy --all-targets -- -D warnings
+    - cargo test --locked
+    - cargo build --release --locked
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+      when: never
+    - when: always
+
+# runs only from a pipeline schedule, so set one up in the project settings
+audit:
+  script:
+    - cargo install cargo-audit --locked
+    - cargo audit
+    # reports dependencies that have drifted behind, without changing the lockfile
+    - cargo update --dry-run
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+  allow_failure: true
+
+# the msrv declared in Cargo.toml, so it fails when something needs a newer rustc
+msrv:
+  image: rust:1.85
+  script:
+    - cargo build --locked
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+      when: never
+    - when: always