diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..3ab1b7d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build debug APK
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Switch to JDK 11 for legacy Gradle build
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '11'
+
+      - name: Build debug APK
+        run: ./gradlew assembleDebug --stacktrace
+
+      - name: Upload APK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Notes-debug-apk
+          path: app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
diff --git a/AGENTS.md b/AGENTS.md
index 9b73723..2a91b27 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,11 +20,13 @@ chmod +x gradlew && ./gradlew assembleDebug   # build debug APK (what CI/release
 ./gradlew lint                                # Android lint (not part of any workflow)
 ```
 
-- There is no CI on push/PR. `.github/workflows/android.yml` runs only manually
-  (`workflow_dispatch`, debug or release input): it builds a debug APK with JDK 11; the "release"
-  input additionally tags `v<versionName>` and publishes the APK to GitHub Releases with generated notes.
+- CI (`.github/workflows/ci.yml`) runs `assembleDebug` (JDK 11) on every push to `main` and every PR,
+  uploading the debug APK as an artifact; the `build` check is required by branch protection.
+  `.github/workflows/android.yml` remains manual (`workflow_dispatch`, debug or release input): it
+  builds a debug APK with JDK 11; the "release" input additionally tags `v<versionName>` and
+  publishes the APK to GitHub Releases with generated notes.
 - Local sandboxes often lack the Android SDK/JDK or other toolchains — if builds can't run locally,
-  rely on careful code review and let a manual workflow run verify. Never skip updating tests when changing shared interfaces.
+  rely on careful code review and let CI verify. Never skip updating tests when changing shared interfaces.
 
 ## Architecture