diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..91be08a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,23 @@
+version: 2
+updates:
+  # npm dependencies — grouped into a single weekly PR to keep noise low. This
+  # complements GitHub's security updates, which continue to open their own PRs.
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      npm:
+        patterns:
+          - "*"
+
+  # Keep the GitHub Actions used in .github/workflows pinned to current versions.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..5644d7c
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Cancel superseded runs on the same ref (e.g. rapid pushes to a PR).
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: verify (node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # engines.node is ">=20"; exercise the floor and the current LTS.
+        node: [20, 22]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build
+
+      # The suite is hermetic: env.ts gets a dummy key from vitest.config.ts and
+      # Supabase/Neo4j/embeddings stay unset, so no external services are needed.
+      - name: Test
+        run: npm test
diff --git a/README.md b/README.md
index 1fb0d16..2d8f89c 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # ARES-AGENT
 
+[![CI](https://github.com/daemon-blockint-tech/4r3s/actions/workflows/ci.yml/badge.svg)](https://github.com/daemon-blockint-tech/4r3s/actions/workflows/ci.yml)
+
 **Autonomous Solana program security auditor** built on LangGraph (JS), OpenRouter,
 a five-level "Crystalline" cognitive memory layer, and a hybrid (Supabase +
 Neo4j) knowledge base.
@@ -125,6 +127,13 @@ The test suite runs the full graph end-to-end with a fake LLM and an in-memory
 store, exercising the parallel fan-out, the concat-reducer findings channel, and
 Crystalline persistence — with Supabase/Neo4j unset to prove graceful fallback.
 
+### Continuous integration
+
+`.github/workflows/ci.yml` runs the four commands above (typecheck, lint, build,
+test) on every push and pull request to `main`, across Node 20 and 22. Because
+the suite is hermetic, CI needs no secrets or services. Dependency updates are
+grouped into weekly Dependabot PRs (`.github/dependabot.yml`).
+
 ## Configuration
 
 All variables are documented in `.env.example`. Only `OPENROUTER_API_KEY` is