diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..b1738cd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,2 @@
+self-hosted-runner:
+  labels: [hetzner]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..10fb586
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+---
+name: CI
+
+"on":
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    # Fork PRs never run on the self-hosted runner.
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, Linux, X64, hetzner]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        env:
+          SKIP: no-commit-to-branch
diff --git a/renovate-automerge.json b/renovate-automerge.json
new file mode 100644
index 0000000..b9efbd7
--- /dev/null
+++ b/renovate-automerge.json
@@ -0,0 +1,17 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Shared bot-PR automerge policy for bakerboy448/* and baker-scripts/*: patch and minor updates automerge once CI passes, after a 3-day release-age hold. Public repos use GitHub auto-merge gated on required status checks. Private repos on GitHub Free set platformAutomerge to false, so Renovate merges only when every status check on the branch is green and never when a branch has zero checks. Rules in a repo's own config come after this preset and win.",
+  "platformAutomerge": true,
+  "ignoreTests": false,
+  "packageRules": [
+    {
+      "description": "Patch and minor updates: automerge when CI is green, held 3 days so a bad release surfaces first",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "minimumReleaseAge": "3 days",
+      "automerge": true
+    }
+  ]
+}
diff --git a/renovate.json b/renovate.json
index 3dcd5b6..93ecaea 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,6 +3,7 @@
   "description": "Inlined house Renovate config — self-contained, public presets only.",
   "extends": [
     "config:best-practices",
+    "github>baker-scripts/.github:renovate-automerge",
     ":dependencyDashboard",
     ":semanticCommits",
     ":enableVulnerabilityAlertsWithLabel(security)"
@@ -21,7 +22,6 @@
   "separateMajorMinor": true,
   "separateMinorPatch": false,
   "automerge": false,
-  "platformAutomerge": false,
   "rebaseWhen": "conflicted",
   "branchPrefix": "renovate/",
   "ignoreDeps": [],