diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..a418290
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,50 @@
+name: CI
+on:
+  push:
+  pull_request:
+
+jobs:
+  test-debian-like:
+    strategy:
+      fail-fast: false
+      matrix:
+        image:
+          - ubuntu:latest
+          - ubuntu:20.04
+          - ubuntu:22.04
+          - debian:testing
+          - debian:stable
+          - debian:oldstable
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ matrix.image }}
+    steps:
+      - name: install dependencies
+        run: |
+          apt-get update &&
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+              automake \
+              build-essential \
+              ca-certificates \
+              git \
+              pkg-config \
+              python3 \
+              scdoc \
+              systemd \
+              ;
+      - uses: actions/checkout@v4
+      - name: autogen
+        run: ./autogen
+      - name: configure
+        run: ./configure
+      - name: check
+        run: make VERBOSE=1 AM_COLOR_TESTS=always check
+      - name: distcheck
+        run: make VERBOSE=1 AM_COLOR_TESTS=always distcheck
+      - name: distribution tarball is complete
+        run: ./.github/workflows/scripts/dist-tarball-check
+      - if: ${{ matrix.image == 'debian:testing' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: distribution-tarball
+          path: keyd-*.tar.gz
diff --git a/.github/workflows/scripts/dist-tarball-check b/.github/workflows/scripts/dist-tarball-check
new file mode 100755
index 0000000..5f968b8
--- /dev/null
+++ b/.github/workflows/scripts/dist-tarball-check
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+pecho() { printf %s\\n "$*"; }
+log() { pecho "$@"; }
+warning() { log "::warning::$@"; }
+error() { log "::error::$@"; }
+fatal() { error "$@"; exit 1; }
+try() { "$@" || fatal "'$@' failed"; }
+
+dist_tarball=$(ls keyd-*.tar.gz) \
+    || fatal "'make dist' must be run before this test"
+
+tmpdir=$(try mktemp -d) || exit 1
+
+log "Copying contents of Git repository..."
+try git archive --format=tar --prefix=git-repo/ HEAD \
+    | try tar -C "${tmpdir}" -xv || exit 1
+(
+    try cd "${tmpdir}"/git-repo
+    # Delete files checked into Git that shouldn't be in the distribution
+    # tarball.
+    try rm -rf \
+        .gitattributes \
+        .github \
+        .gitignore \
+        ;
+) || exit 1
+
+log "Extracting distribution tarball..."
+try tar -C "${tmpdir}" -xvzf "${dist_tarball}"
+try mv "${tmpdir}/${dist_tarball%.tar.gz}" "${tmpdir}"/dist-tarball
+(
+    try cd "${tmpdir}"/dist-tarball
+    # Delete generated files
+    try rm -rf \
+        Makefile.in \
+        aclocal.m4 \
+        build-aux/install-sh \
+        build-aux/missing \
+        build-aux/tap-driver.sh \
+        configure \
+        ;
+) || exit 1
+
+log "Comparing Git repository with distribution tarball..."
+cd "${tmpdir}"
+diff -qNr git-repo dist-tarball >/dev/null || {
+    error "Unexpected diff between the repo and the distribution tarball."
+    error "You may need to add a file to EXTRA_DIST in Makefile.am."
+    error "Diff output:"
+    diff -uNr git-repo dist-tarball \
+        | while IFS= read -r line; do error "${line}"; done
+    exit 1
+}
+log "No difference"