diff --git a/.github/workflows/control.yml b/.github/workflows/control.yml
new file mode 100644
index 0000000..6c249da
--- /dev/null
+++ b/.github/workflows/control.yml
@@ -0,0 +1,52 @@
+name: control-plane
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch: {}
+
+concurrency:
+  group: control-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  control:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Optional: check out meridian-node so the cross-repo tests run against the
+      # real node agent. Needs a token with read access to the (private) repo;
+      # without it the cross-repo tests skip via importorskip, and the rest of the
+      # control suite (service, mTLS binding, migrations, projection) still runs.
+      - name: Checkout meridian-node (optional)
+        id: node
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: IMV-IN/meridian-node
+          path: meridian-node
+          token: ${{ secrets.MERIDIAN_NODE_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install control (+ node agent if available)
+        run: |
+          pip install -e ".[control,dev]"
+          if [ "${{ steps.node.outcome }}" = "success" ]; then
+            pip install -e ./meridian-node[http]
+          fi
+
+      - name: Lint + type-check control
+        run: |
+          ruff check meridian_control tests/control
+          mypy meridian_control
+
+      - name: Test control (+ cross-repo connection if node is present)
+        run: pytest tests/control -q