diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..09c446a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..f498209
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,66 @@
+name: brew test-bot
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    # Weekly canary. Homebrew deprecations that land between cask bumps show
+    # up here first, and the online audit below checks that latest.json is
+    # still reachable and that livecheck still resolves the current version.
+    # Note: GitHub disables scheduled runs on a public repo after 60 days
+    # without a commit; re-enable the workflow if that happens.
+    - cron: "20 7 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+
+env:
+  # test-bot sets this itself, but pin it so a plain `brew audit` step in this
+  # workflow also fails hard on deprecations instead of staying silent.
+  HOMEBREW_DEVELOPER: 1
+  TAP: runthewall/tap
+
+jobs:
+  test-bot:
+    strategy:
+      matrix:
+        os: [ macos-26 ]
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    steps:
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@f8d4222eb633e65c2a0157383cf80861fc7fae7f # 2026.09.07.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check the tap was detected
+        run: test "${{ steps.set-up-homebrew.outputs.tap-name }}" = "$TAP"
+
+      - name: Cache Homebrew Bundler RubyGems
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
+          key: ${{ matrix.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
+          restore-keys: ${{ matrix.os }}-rubygems-
+
+      - run: brew test-bot --only-tap-syntax
+
+      # The tap-syntax audit is offline, so livecheck is only parsed there.
+      # Run it for real once a week.
+      - name: Online audit and livecheck
+        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        run: |
+          brew audit --cask --online --tap="$TAP"
+          brew livecheck --cask --tap "$TAP"
diff --git a/Casks/constly.rb b/Casks/constly.rb
index feec128..22de817 100644
--- a/Casks/constly.rb
+++ b/Casks/constly.rb
@@ -10,6 +10,14 @@
   desc "WYSIWYG markdown editor that renders the marks away as you type"
   homepage "https://constly.com/"
 
+  livecheck do
+    url "https://downloads.constly.com/latest.json"
+    regex(/^v?(\d+(?:\.\d+)+)$/i)
+    strategy :json do |json, regex|
+      json["version"].to_s[regex, 1]
+    end
+  end
+
   # Constly ships its own signed, minisign-verified auto-updater; let it drive
   # upgrades so brew never fights the in-app update (per RTW distribution
   # decision, 7 Aug 2026). `brew upgrade` becomes a no-op for this cask.