diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1f18176
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..0e625ca
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  manifest:
+    name: manifest validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      # Pip's idf-component-manager (3.x) has `compote manifest lint`, unlike the
+      # 2.5.0 bundled with ESP-IDF 6.0.1 (schema/create/add-dependency only) -- no
+      # need for the full ESP-IDF docker image just to validate a manifest.
+      - run: pip install idf-component-manager
+
+      - name: Lint manifest
+        run: compote manifest lint components/microlink/idf_component.yml
+
+      - name: Pack component (same validation the registry runs on upload)
+        run: compote -W component pack --project-dir components/microlink --name microlink
diff --git a/components/microlink/idf_component.yml b/components/microlink/idf_component.yml
new file mode 100644
index 0000000..21ccc2e
--- /dev/null
+++ b/components/microlink/idf_component.yml
@@ -0,0 +1,25 @@
+version: "3.0.0"  # x-release-please-version
+description: >-
+  Tailscale-protocol network stack for ESP32 (FuGo fork of CamM2325/microlink,
+  ESP-IDF 6.x only): ts2021 control plane, WireGuard data plane, DISCO/STUN,
+  DERP relay, optional 4G cellular with WiFi failover.
+url: https://github.com/fugo101/microlink
+repository: https://github.com/fugo101/microlink.git
+issues: https://github.com/fugo101/microlink/issues
+license: MIT
+tags: [tailscale, wireguard, vpn, networking, cellular]
+
+dependencies:
+  idf:
+    # Floor 6.0: src/ml_noise.c includes <mbedtls/private/chachapoly.h>, which
+    # only exists in the TF-PSA-Crypto tree shipped from ESP-IDF 6.0 onward.
+    # Ceiling <7.0: 6.x-specific compat has not been tested/patched for 7.x.
+    version: ">=6.0,<7.0"
+  espressif/cjson:
+    version: "^1.7.19"
+  fugo101/wireguard_lwip:
+    # Separate repo (fugo101/wireguard-lwip, a real fork of
+    # smartalock/wireguard-lwip), its own independent release-please --
+    # this version number has nothing to do with microlink's own version.
+    # Bump by hand when needed; there is no auto-sync between the two repos.
+    version: "^1.0.0"