diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
new file mode 100644
index 0000000..72a9d05
--- /dev/null
+++ b/.forgejo/workflows/validate.yml
@@ -0,0 +1,73 @@
+name: validate
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  json-schema:
+    name: JSON Schema (ajv)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install ajv
+        run: npm install -g ajv-cli@5 ajv-formats@3
+
+      - name: Validate every JSON Schema parses as JSON
+        run: |
+          set -euo pipefail
+          find schemas -type f -name '*.json' -print | while read -r f; do
+            echo "--- parse: $f"
+            node -e "require('./$f')"
+          done
+
+      - name: Validate each schema is itself valid against JSON Schema 2020-12
+        run: |
+          set -euo pipefail
+          find schemas -type f -name '*.json' -print | while read -r f; do
+            echo "--- meta-validate: $f"
+            ajv compile --spec=draft2020 -c ajv-formats -s "$f"
+          done
+
+      - name: Validate example payloads against their schemas
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          # Convention: schemas/.../v<version>.json may have sibling
+          # examples/*.json documents to validate against the schema.
+          for schema in $(find schemas -type f -name '*.json'); do
+            dir="$(dirname "$schema")/examples"
+            [ -d "$dir" ] || continue
+            for example in "$dir"/*.json; do
+              echo "--- validate example $example against $schema"
+              ajv validate --spec=draft2020 -c ajv-formats -s "$schema" -d "$example"
+            done
+          done
+
+  rego:
+    name: Rego (opa fmt + opa test)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install OPA
+        run: |
+          set -euo pipefail
+          curl -sSL -o /usr/local/bin/opa https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
+          chmod +x /usr/local/bin/opa
+          opa version
+
+      - name: opa fmt (fail on any diff)
+        run: opa fmt --list --diff policies/
+
+      - name: opa test
+        run: opa test policies/ -v