diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..b1738cd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,2 @@
+self-hosted-runner:
+  labels: [hetzner]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..2bd6932
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+---
+name: CI
+
+"on":
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  docs-build:
+    # Fork PRs never run on the self-hosted runner.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, Linux, X64, hetzner]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+
+      - run: pip install mkdocs-material
+
+      - run: mkdocs build
diff --git a/renovate.json b/renovate.json
index 76de726..0d3a593 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,6 +3,7 @@
   "description": "Inlined house Renovate config — self-contained, public presets only.",
   "extends": [
     "config:best-practices",
+    "github>baker-scripts/.github:renovate-automerge",
     ":dependencyDashboard",
     ":semanticCommits",
     ":enableVulnerabilityAlertsWithLabel(security)"
@@ -21,7 +22,6 @@
   "separateMajorMinor": true,
   "separateMinorPatch": false,
   "automerge": false,
-  "platformAutomerge": false,
   "rebaseWhen": "behind-base-branch",
   "branchPrefix": "renovate/",
   "ignoreDeps": [],