diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..238c74b
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,33 @@
+name: tests
+
+# Run the unit suite inside the actual container image, not against a bare Python
+# on the runner — the image is the artifact we ship, so it's the thing we test.
+# tests/ is excluded from the image by .dockerignore, so we mount it read-only
+# into the built image and run unittest from /app (where the modules live).
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  container-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build the Layover image
+        run: docker build -t layover:ci .
+
+      - name: Run unit tests inside the container
+        # Override the image ENTRYPOINT (scheduler.py — a forever loop) so the
+        # container runs the tests and exits instead of starting the scheduler.
+        run: >
+          docker run --rm
+          --entrypoint python3
+          -e PYTHONDONTWRITEBYTECODE=1
+          -v "${{ github.workspace }}/tests:/app/tests:ro"
+          -w /app
+          layover:ci
+          -m unittest discover -s tests -v