diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..9bf2017
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,31 @@
+name: test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+# supersede in-flight PR runs, but never cancel a master run mid-flight
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # No `cache: npm`: the cache key hashes a lockfile this package
+      # deliberately does not ship, and the step errors out without one.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: lts/*
+
+      - run: npm test
diff --git a/package.json b/package.json
index ecb79a4..782dcdb 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "./styles/*": "./src/styles/*"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test src/styles/contrast.test.mjs"
   },
   "peerDependencies": {
     "@astrojs/starlight": "^0.42.0",