diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..db1d08c7
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run full test suite
+    runs-on: ubuntu-latest
+
+    env:
+      HERA_DB_USER: hera
+      HERA_DB_PASS: heracles
+      HERA_DB_NAME: hera_ci
+
+    services:
+      mongodb:
+        image: mongo:latest
+        ports:
+          - 27017:27017
+        env:
+          MONGO_INITDB_ROOT_USERNAME: hera
+          MONGO_INITDB_ROOT_PASSWORD: heracles
+        options: >-
+          --health-cmd "mongosh --quiet -u hera -p heracles --authenticationDatabase admin --eval 'db.runCommand({ ping: 1 }).ok' | grep -q 1"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - name: Checkout hera
+        uses: actions/checkout@v4
+
+      - name: Checkout hermes (internal dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: KaplanOpenSource/hermes
+          path: _vendor/hermes
+          # token: ${{ secrets.INTERNAL_REPO_PAT }}   # uncomment if private
+
+      - name: Checkout argos (internal dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: KaplanOpenSource/argos
+          path: _vendor/argos
+          # token: ${{ secrets.INTERNAL_REPO_PAT }}   # uncomment if private
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+          cache-dependency-path: requirements.txt
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgdal-dev gdal-bin
+
+      - name: Install Python dependencies
+        run: |
+          python -m pip install --upgrade pip setuptools wheel
+          pip install -r requirements.txt
+          pip install -e ./_vendor/hermes
+          pip install -e ./_vendor/argos
+          pip install -e . --no-deps
+
+      - name: Write ~/.pyhera/config.json
+        run: |
+          mkdir -p "$HOME/.pyhera"
+          python - <<'PY'
+          import json, os, getpass
+          cfg = {
+              getpass.getuser(): {
+                  "dbIP":     "127.0.0.1",
+                  "dbName":   os.environ["HERA_DB_NAME"],
+                  "username": os.environ["HERA_DB_USER"],
+                  "password": os.environ["HERA_DB_PASS"],
+              }
+          }
+          with open(os.path.expanduser("~/.pyhera/config.json"), "w") as f:
+              json.dump(cfg, f, indent=4, sort_keys=True)
+          print("wrote pyhera config for user:", getpass.getuser())
+          PY
+
+      - name: Wait for MongoDB
+        run: |
+          for i in {1..30}; do
+            if (echo > /dev/tcp/127.0.0.1/27017) 2>/dev/null; then
+              echo "MongoDB is up"; exit 0
+            fi
+            sleep 2
+          done
+          echo "MongoDB did not become available"; exit 1
+
+      - name: Run full test suite
+        run: pytest hera/tests/ -v -m "not notebook"
+        env:
+          MPLBACKEND: Agg
diff --git a/requirements.txt b/requirements.txt
index 5a9d730c..4719ae52 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -149,7 +149,6 @@ jupyterlab_widgets==3.0.13
 kafka-python==2.0.6
 kaleido==0.2.1
 kiwisolver==1.4.7
-ksql==0.10.2
 libclang==18.1.1
 libpysal==4.8.1
 llvmlite==0.43.0
@@ -297,7 +296,7 @@ soupsieve==2.6
 spaghetti==1.7.4
 spglm==1.1.0
 Sphinx==7.4.7
-sphinx-basic-ng>=1.0.0
+sphinx-basic-ng==1.0.0b2
 sphinx-gallery==0.19.0
 sphinx-jsonschema==1.19.1
 sphinx-rtd-theme==3.0.2