diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c940223
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,18 @@
+name: CI
+
+# This repo has no PR gate. The pins check is the whole job -- it is cheap, needs
+# no secrets, and stops the Dockerfile and the manifest drifting apart again.
+# Adding it does NOT make this repo tier 2: nothing here auto-merges.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: WeMoveEU/ci-workflows/.github/actions/python-pins@2e7432e38558f800d0ba71e813dac22cffdc2076
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..25aa97d
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,3 @@
+# TEMPORARY -- do not merge. Mimics the real incident: Dependabot walks the base
+# image ahead of the manifest, which stays green because a floor accepts it.
+FROM python:3.14-slim
diff --git a/pyproject.toml b/pyproject.toml
index 8cd4579..5c73574 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -21,6 +21,13 @@ build-backend = "setuptools.build_meta"
 [tool.setuptools]
 packages = ["actionkit"]
 
+[tool.python-pins]
+# requires-python is a compatibility range here, not a runtime pin: six repos
+# import this library from an unpinned git URL and they span 3.11 to 3.14, so no
+# single ==X.Y.* satisfies all of them. `library` opts out of the form rule only
+# -- the values still have to agree with each other.
+role = "library"
+
 [dependency-groups]
 dev = [
     "pytest>=7.0.1",