diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c1590f3
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install with the dev extra
+        run: python -m pip install -e ".[dev]"
+      - name: Tests
+        run: python -m pytest
+      # Fetches the public OpenAPI spec; no secrets involved.
+      - name: Codegen check
+        run: python codegen/check.py
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e0fc979..ea9e925 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,6 +16,11 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
+      # Gate: a failing test stops the job before the publish step runs.
+      - name: Install with the dev extra
+        run: python -m pip install -e ".[dev]"
+      - name: Tests
+        run: python -m pytest
       - run: pip install build
       - run: python -m build
       - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f79181e..5ac580d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+- Added `form4api.__version__` (read from the installed package metadata, so it
+  always equals the pyproject version).
+
 ## 0.9.0 — 2026-10-05
 
 - **Congress date quality (backend insiderapi #330/#331).** `CongressTradeDto`
diff --git a/form4api/__init__.py b/form4api/__init__.py
index 5eeb127..1125751 100644
--- a/form4api/__init__.py
+++ b/form4api/__init__.py
@@ -1,4 +1,7 @@
 from form4api._client import AsyncForm4ApiClient, Form4ApiClient
+# Single source of truth is pyproject.toml: _client reads the installed package
+# metadata, so this cannot drift from the published version.
+from form4api._client import _SDK_VERSION as __version__
 from form4api._errors import (
     AuthError,
     Form4ApiError,
@@ -24,6 +27,7 @@
 from form4api._webhook_utils import verify_webhook
 
 __all__ = [
+    "__version__",
     "Form4ApiClient",
     "AsyncForm4ApiClient",
     "Form4ApiError",