diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..713c416
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,12 @@
+# Runner labels the Cubeage workflows and the reusable workflows they call
+# request; actionlint rejects any label not listed here.
+self-hosted-runner:
+  labels:
+    - standard
+    - sylphx
+    - sylphx-linux-standard
+    - sylphx-linux-control
+    - sylphx-linux-xlarge
+    - sylphx-linux-standard-merge
+    - sylphx-linux-xlarge-merge
+    - sylphx-registry-publisher
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..625c3af
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,53 @@
+name: CI
+
+# One gate for this repository: every check runs under this workflow and the
+# `ci-ok` aggregate is the required status check (ruleset sylphx-merge-queue).
+# content-checks, game-standard-action and ftl-daily-budget-action are called
+# from here (workflow_call only), so their jobs count toward `ci-ok`.
+on:
+  pull_request:
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  content-checks:
+    uses: ./.github/workflows/content-checks.yml
+
+  game-standard-action:
+    uses: ./.github/workflows/game-standard-action.yml
+
+  ftl-daily-budget-action:
+    uses: ./.github/workflows/ftl-daily-budget-action.yml
+
+  # Parse and lint every workflow with the pinned actionlint 1.7.12 and this
+  # repository's .github/actionlint.yaml (runner labels).
+  workflow-lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: SylphxAI/.github/.github/actions/workflow-lint@a0d0ef46284e23283417d3d34063ea38882a0333
+        with:
+          args: |
+            -config-file
+            .github/actionlint.yaml
+
+  # The required check. Skipped jobs pass; failed or cancelled ones fail. This
+  # repository is public, so its runner groups do not serve it (public
+  # repositories are not allowed on them) and every job here uses GitHub's free
+  # hosted runner; sylphx-linux-control would queue forever.
+  ci-ok:
+    if: always()
+    needs: [content-checks, game-standard-action, ftl-daily-budget-action, workflow-lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: SylphxAI/.github/.github/actions/needs-pass@a0d0ef46284e23283417d3d34063ea38882a0333
+        with:
+          needs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/content-checks.yml b/.github/workflows/content-checks.yml
index bc60153..d58a3fb 100644
--- a/.github/workflows/content-checks.yml
+++ b/.github/workflows/content-checks.yml
@@ -6,8 +6,7 @@ name: content-checks
 # - zh-hant (owner standards/experience.md): advisory until 2026-10-02. On that
 #   date drop its continue-on-error and make the "zh-hant" check required.
 on:
-  pull_request:
-  merge_group:
+  workflow_call:
 
 permissions:
   contents: read
diff --git a/.github/workflows/ftl-daily-budget-action.yml b/.github/workflows/ftl-daily-budget-action.yml
index 5455a4f..58862a6 100644
--- a/.github/workflows/ftl-daily-budget-action.yml
+++ b/.github/workflows/ftl-daily-budget-action.yml
@@ -5,8 +5,7 @@ name: ftl-daily-budget-action
 # runs the same way); a title repository runs the action on
 # sylphx-linux-standard.
 on:
-  pull_request:
-  merge_group:
+  workflow_call:
 
 permissions:
   contents: read
diff --git a/.github/workflows/game-standard-action.yml b/.github/workflows/game-standard-action.yml
index 8c20b11..7b71e76 100644
--- a/.github/workflows/game-standard-action.yml
+++ b/.github/workflows/game-standard-action.yml
@@ -4,8 +4,7 @@ name: game-standard-action
 # free standard hosted runners are allowed here (content-checks.yml runs the
 # same way); a title repository runs the action on sylphx-linux-standard.
 on:
-  pull_request:
-  merge_group:
+  workflow_call:
 
 permissions:
   contents: read