diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..5341f13
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,48 @@
+name: Public source validation
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: EventLens-Public-validation
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: linux-validation
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Validate backend
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m pip install uv==0.10.0
+          cd backend
+          python3 -m uv sync --locked --extra dev
+          python3 -m uv run --locked --extra dev pytest -q -W error::DeprecationWarning
+          python3 -m uv run --locked --extra dev ruff check .
+      - name: Validate frontend
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd frontend
+          npm ci --no-audit --no-fund
+          npm test
+          npm run lint
+          npm run build
diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index f380ad4..dc61391 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `a4e870168c00a9010bac0b821885602378a9e87f`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `8f9b57a425e88c7efda5bba3212d1c8aae5b4d02`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index c6aa766..8e2f708 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,12 +1,17 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "a4e870168c00a9010bac0b821885602378a9e87f",
+  "sourceRevision": "8f9b57a425e88c7efda5bba3212d1c8aae5b4d02",
   "files": [
     {
       "path": ".dockerignore",
       "sha256": "663daf09083ac1f8aeb1582e31d83c493f1658e60032854495e1031460156d64",
       "bytes": 244
     },
+    {
+      "path": ".gitea/workflows/ci.yml",
+      "sha256": "d2da54058d2caf5095dffc4782376ed3734ab1b58ff6497ca2eb9ea021fb932b",
+      "bytes": 1322
+    },
     {
       "path": ".gitignore",
       "sha256": "7ba7eaae5eb39c261758cdd1736cf7631476766927d12e1c49f29b11c85cceac",