diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index 609c836..c46e59c 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -113,3 +113,44 @@ jobs:
       - name: opa test
         working-directory: ${{ github.workspace }}
         run: opa test policies/ -v
+
+  go:
+    name: Go (vet + test)
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.23-trixie
+    steps:
+      - name: Install git + curl in container
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends git curl ca-certificates
+          git --version
+          go version
+
+      - name: Clone repository (sha256-aware)
+        run: |
+          set -euo pipefail
+          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
+            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
+          cd "${GITHUB_WORKSPACE}"
+          git log -1 --oneline
+
+      - name: Enumerate Go modules
+        id: mods
+        working-directory: ${{ github.workspace }}
+        run: |
+          set -eu
+          # List every directory that contains a go.mod and run vet+test there.
+          # Shell-quoted paths handle spaces.
+          find services -type f -name 'go.mod' -print | sed 's|/go.mod$||' | sort -u | tee /tmp/go_modules.txt
+
+      - name: go vet + test for every module
+        working-directory: ${{ github.workspace }}
+        run: |
+          set -eu
+          while IFS= read -r m; do
+            [ -n "$m" ] || continue
+            echo "=== $m ==="
+            (cd "$m" && go vet ./... && go test ./...)
+          done < /tmp/go_modules.txt
diff --git a/README.md b/README.md
index 113beca..cf51aff 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,10 @@ docs/
     0001-first-rollout-db-app-scope.md
     0002-session-scope-token-format.md
     0003-pii-retention-policy.md
+    0004-db-migrations.md
+db/
+  README.md
+  trust/migrations/0001_per_diem_rates.{up,down}.sql
 schemas/
   README.md
   expense/canonical/{v1.0.0,v1.1.0,v1.2.0}.json
@@ -68,9 +72,10 @@ policies/
   sinks/expense_db_app.rego (+ _test.rego)
   data_sources/{expense_db_app,receipts,per_diem_rates}.rego (+ _test.rego)
 services/
-  per-diem-calculator/   # deterministic calculator (Go), currently skeleton
+  per-diem-calculator/   # deterministic calculator (Go)
+  admin-api/             # admin surface for per-diem rate management (Go)
 .forgejo/workflows/
-  validate.yml    # JSON-Schema (ajv) + Rego (opa fmt + opa test)
+  validate.yml    # JSON-Schema (ajv) + Rego (opa fmt + opa test) + Go (vet + test)
 ```
 
 Weitere Verzeichnisse (weitere Services, Deployment-Manifeste, Senken-/Datenquellen-Adapter) folgen im Zuge der Architekturentwicklung.
@@ -92,6 +97,10 @@ npx -y ajv-cli@5 compile --spec=draft2020 -c ajv-formats \
 # Rego
 opa fmt --list --diff policies/
 opa test policies/ -v
+
+# Go services
+(cd services/admin-api && go vet ./... && go test ./...)
+(cd services/per-diem-calculator && go vet ./... && go test ./...)
 ```
 
 CI (`.forgejo/workflows/validate.yml`) läuft dieselben Prüfungen auf jedem Push und PR gegen `main`.