diff --git a/.github/workflows/build-linux-native.yml b/.github/workflows/build-linux-native.yml
new file mode 100644
index 0000000000..d3e8cc84ee
--- /dev/null
+++ b/.github/workflows/build-linux-native.yml
@@ -0,0 +1,50 @@
+name: Build Linux (distro packages)
+
+# Self-contained CI job: builds against the SDL2/OpenAL/libnoise packages
+# shipped by the distro instead of Conan profiles. It needs no external
+# services, so it keeps working even if third-party infrastructure
+# (personal git servers, CDN downloads) goes away.
+
+on: [push, pull_request]
+
+jobs:
+  linux-gcc:
+    name: Linux (GCC, distro packages)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          echo -e 'pcm.!default {\n type plug\n slave.pcm "null"\n}' > ~/.asoundrc
+          sudo apt-get update
+          sudo apt-get -y install \
+            ninja-build \
+            libsdl2-dev \
+            libsdl2-image-dev \
+            libsdl2-ttf-dev \
+            libnoise-dev \
+            libpng-dev \
+            zlib1g-dev \
+            libopenal-dev \
+            libvorbis-dev
+
+      - name: Configure
+        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TEST=ON -G Ninja
+
+      - name: Build
+        run: cmake --build build -j"$(nproc)"
+
+      - name: Test
+        env:
+          SDL_VIDEODRIVER: dummy
+          SDL_AUDIODRIVER: dummy
+        run: ctest --test-dir build --output-on-failure -j2
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: Cytopia-linux-${{ github.sha }}
+          path: |
+            build/bin/Cytopia
+            data/resources
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index f6ab473c4f..c98ef49853 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -9,6 +9,9 @@ on:
 jobs:
   build:
     name: sonarcloud scan
+    # Only run on the upstream repo: forks lack the SONAR_TOKEN secret and the
+    # scan step downloads a runner script from an external CDN.
+    if: github.repository == 'CytopiaTeam/Cytopia'
     runs-on: ubuntu-latest
     env:
       CONAN_SYSREQUIRES_MODE: "enabled"