diff --git a/.gitea/workflows/check.yaml b/.gitea/workflows/check.yaml
new file mode 100644
index 0000000..5bc7e68
--- /dev/null
+++ b/.gitea/workflows/check.yaml
@@ -0,0 +1,22 @@
+name: check
+on:
+  push:
+    branches: [dev]
+
+# ponytail: only because Traefik still serves its default self-signed cert for
+# git.kessinen.com. Remove once the LE-DNS01-cloudflare runbook has been run.
+env:
+  GIT_SSL_NO_VERIFY: "true"
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - run: make check
diff --git a/.gitea/workflows/demo.yaml b/.gitea/workflows/demo.yaml
deleted file mode 100644
index 5b4a7ce..0000000
--- a/.gitea/workflows/demo.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: demo
-on: [push]
-
-# ponytail: GIT_SSL_NO_VERIFY is here only because Traefik still serves its
-# default self-signed cert for git.kessinen.com. Remove it once the
-# LE-DNS01-cloudflare runbook has been run.
-env:
-  GIT_SSL_NO_VERIFY: "true"
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "hello from ${{ gitea.repository }} on ${{ gitea.ref }}"
-      - uses: actions/checkout@v4
-      - run: ls -la && git log --oneline -1