diff --git a/.gitea/workflows/validate.yml b/.gitea/workflows/validate.yml
new file mode 100644
index 0000000..d85f789
--- /dev/null
+++ b/.gitea/workflows/validate.yml
@@ -0,0 +1,63 @@
+# Two gates, neither of which needs a robot: the dataflow still matches the
+# typed contract in dora-node.yml, and the node's own tests pass.
+name: validate
+
+# A pull request would otherwise run this twice on the same commit: once for the
+# branch push and once for the PR.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  DORA_VERSION: v1.0.1
+  DORA_TARGET: x86_64-unknown-linux-gnu
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install the dora CLI
+        run: |
+          curl -fsSL -o dora-cli.tar.gz \
+            "https://github.com/dora-rs/dora/releases/download/${DORA_VERSION}/dora-cli-${DORA_TARGET}.tar.gz"
+          tar xzf dora-cli.tar.gz
+          mkdir -p "$HOME/.local/bin"
+          install -m 755 "dora-cli-${DORA_TARGET}/dora" "$HOME/.local/bin/dora"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          rm -rf dora-cli.tar.gz "dora-cli-${DORA_TARGET}"
+
+      - run: dora --version
+
+      # strict_types: true in the dataflow turns a type warning into a non-zero
+      # exit, so a mismatched annotation fails here rather than at runtime.
+      - name: Validate the dataflow
+        run: dora validate dataflow.yml
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      # --locked fails if uv.lock is out of date with pyproject.toml, so a
+      # dependency change that was never locked cannot reach main.
+      - name: Install
+        run: uv sync --locked --group dev
+
+      - run: uv run ruff check .
+
+      - run: uv run pytest -q
+
+  markdownlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DavidAnson/markdownlint-cli2-action@v16
+        with:
+          globs: "*.md"
diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
deleted file mode 100644
index 4067a80..0000000
--- a/.github/workflows/markdownlint.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: markdownlint
-
-on:
-  push:
-    paths:
-      - "**.md"
-      - ".markdownlint.json"
-  pull_request:
-    paths:
-      - "**.md"
-      - ".markdownlint.json"
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - run: npm install -g markdownlint-cli2
-      - run: markdownlint-cli2 "**/*.md"