diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
new file mode 100644
index 0000000..31316d1
--- /dev/null
+++ b/.github/workflows/ai-review.yml
@@ -0,0 +1,24 @@
+# AI code review, delegated to klein-cli's reusable workflow.
+#
+# Trust model: this uses `on: pull_request` (NOT pull_request_target) and the
+# job is gated to same-repository branches below, so the API-key secret is only
+# ever exposed to code from contributors who already have push access. Fork PRs
+# get no secrets and are skipped.
+name: AI Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    uses: fpt/klein-cli/.github/workflows/ai-review-reusable.yml@main
+    with:
+      language: en
+    secrets:
+      openai-api-key: ${{ secrets.OPENAI_API_KEY }}