diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..4f2c458
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,11 @@
+# Runs on the Nix runner on nexus (label `nixos`, host executor).
+name: ci
+on: [push, pull_request]
+
+jobs:
+  check:
+    runs-on: nixos
+    steps:
+      - uses: actions/checkout@v4
+      - name: nix flake check
+        run: nix flake check -L --show-trace
diff --git a/AGENTS.md b/AGENTS.md
index e3b4225..544eb82 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,6 +35,7 @@ Keep it that way.
 ## Checks
 
 ```sh
+nix flake check -L      # all tests below; CI runs this on every push
 nix develop -c cargo test -p sausage -p sausage-actor -p agent
 nix develop -c cargo build --release -p agent --target wasm32-wasip2
 nix develop -c cargo clippy --workspace
diff --git a/flake.nix b/flake.nix
index 0c65791..576e530 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,6 +58,19 @@
       {
         packages.default = sausage;
 
+        # `nix flake check` runs every test of the host, the SDK, and the
+        # agent. The tests build WASM actors with cargo, offline, from the
+        # vendored crates of Cargo.lock.
+        checks.tests = sausage.overrideAttrs (old: {
+          pname = "sausage-tests";
+          doCheck = true;
+          cargoTestFlags = [ "-p" "sausage" "-p" "sausage-actor" "-p" "agent" ];
+          preCheck = ''
+            # Its own lock file pins crates that the vendored set may lack.
+            rm -f cli/tests/actors/toolbox/Cargo.lock
+          '';
+        });
+
         apps.default = { type = "app"; program = "${sausage}/bin/sausage"; };
         apps.loop = { type = "app"; program = "${loop "sausage-loop" publicUrl}/bin/sausage-loop"; };
         apps.loop-internal = { type = "app"; program = "${loop "sausage-loop-internal" internalUrl}/bin/sausage-loop-internal"; };