diff --git a/.gitignore b/.gitignore
index 6940c20..96ce4c9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@ scripts/
 !.prettierrc
 !.env.development
 !.github/
+!.gitlab-ci.yml
 !.vscode/
 .vscode/*
 !.vscode/extensions.json
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..3aaee2f
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,39 @@
+# CI on the self-hosted GitLab, ported from .github/workflows/ci.yml when the
+# GitHub account was suspended on 2026-09-20. The Actions file stays in the
+# tree: it is the reference this was written from and works unchanged if the
+# appeal succeeds.
+#
+# The image is pinned by digest, with its tag in the trailing comment -- the
+# replacement for the workflow's SHA-pinned actions, since GitLab has no
+# action allowlist.
+#
+# Not ported here:
+#   * cleanup.yml pruned GHCR with dataaxiom/ghcr-cleanup-action; on GitLab
+#     that belongs in the project's container registry cleanup policy, not in
+#     a pipeline.
+#   * publish.yml and release.yml still need doing; they are larger and are
+#     being handled separately.
+
+stages: [build]
+
+default:
+  interruptible: true
+
+build:
+  stage: build
+  image: node:22-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9 # 22-bookworm-slim
+  variables:
+    NPM_CONFIG_CACHE: "$CI_PROJECT_DIR/.npm"
+  cache:
+    key:
+      files: [package-lock.json]
+    paths: [.npm/]
+  script:
+    - npm ci --ignore-scripts
+    - npm run typecheck
+    - npm run lint
+    - npm test
+    - npm run build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH