diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..306627a
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# Code owners for dev-toolkit.
+# Pairs with the branch ruleset's "Require review from Code Owners": every change
+# needs @lsr-explore's review before it can merge to a protected branch.
+# (As repo admin on the ruleset's bypass list, you can still merge your own PRs.)
+* @lsr-explore
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..f7c1aa9
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+# CI for dev-toolkit.
+#
+# Adapted from templates/github/ci.yml: this repo is a snippet *library* (npm +
+# markdownlint), not a pnpm frontend app, so it runs the markdown lint rather than
+# lint/typecheck/test. Gives branch protection a real status check to require.
+name: CI
+
+on:
+  push:
+  pull_request:
+
+# Cancel superseded runs on the same ref so PRs don't queue stale jobs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  markdownlint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Lint Markdown
+        run: npm run lint:md
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..2bd5a0a
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+22