diff --git a/.github/actions/install-reqstool/action.yml b/.github/actions/install-reqstool/action.yml
new file mode 100644
index 0000000..7d2a73e
--- /dev/null
+++ b/.github/actions/install-reqstool/action.yml
@@ -0,0 +1,31 @@
+name: "Install reqstool"
+description: "Set up Python and install reqstool from either PyPI (latest release) or reqstool-client@main."
+
+inputs:
+  reqstool-source:
+    description: "Where to install reqstool from: 'pypi' (latest release) or 'main' (reqstool-client@main)."
+    required: false
+    default: "pypi"
+  python-version:
+    description: "Python version to use."
+    required: false
+    default: "3.13"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: ${{ inputs.python-version }}
+
+    - name: Install reqstool
+      shell: bash
+      env:
+        REQSTOOL_SOURCE: ${{ inputs.reqstool-source }}
+      run: |
+        if [ "$REQSTOOL_SOURCE" = "main" ]; then
+          pip install "reqstool @ git+https://github.com/reqstool/reqstool-client.git@main"
+        else
+          pip install reqstool
+        fi
diff --git a/.github/actions/reqstool-status/action.yml b/.github/actions/reqstool-status/action.yml
new file mode 100644
index 0000000..c88e75b
--- /dev/null
+++ b/.github/actions/reqstool-status/action.yml
@@ -0,0 +1,41 @@
+name: "reqstool status"
+description: "Install reqstool (from PyPI or reqstool-client@main) and run reqstool status against a reqstool data path. By default just reports status; set fail-if-incomplete to gate CI on every requirement being complete. Must run after the repo's own build step, in the same job, since it depends on build-time artifacts (e.g. annotations.yml, test results)."
+
+inputs:
+  reqstool-source:
+    description: "Where to install reqstool from: 'pypi' (latest release) or 'main' (reqstool-client@main)."
+    required: false
+    default: "pypi"
+  reqstool-path:
+    description: "Path to the reqstool data directory (containing requirements.yml etc.), relative to repo root."
+    required: false
+    default: "docs/reqstool"
+  fail-if-incomplete:
+    description: "Fail the step unless all requirements are implemented (passes --check-all-reqs-met). Leave false for repos that intentionally have incomplete requirements (e.g. demo/fixture repos)."
+    required: false
+    default: "false"
+  python-version:
+    description: "Python version to use."
+    required: false
+    default: "3.13"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install reqstool
+      uses: ./.github/actions/install-reqstool
+      with:
+        reqstool-source: ${{ inputs.reqstool-source }}
+        python-version: ${{ inputs.python-version }}
+
+    - name: Run reqstool status
+      shell: bash
+      env:
+        FAIL_IF_INCOMPLETE: ${{ inputs.fail-if-incomplete }}
+        REQSTOOL_PATH: ${{ inputs.reqstool-path }}
+      run: |
+        if [ "$FAIL_IF_INCOMPLETE" = "true" ]; then
+          reqstool status --verbosity compact --check-all-reqs-met local -p "$GITHUB_WORKSPACE/$REQSTOOL_PATH"
+        else
+          reqstool status --verbosity compact local -p "$GITHUB_WORKSPACE/$REQSTOOL_PATH"
+        fi
diff --git a/.github/actions/validate-reqstool/action.yml b/.github/actions/validate-reqstool/action.yml
new file mode 100644
index 0000000..216555d
--- /dev/null
+++ b/.github/actions/validate-reqstool/action.yml
@@ -0,0 +1,31 @@
+name: "Validate reqstool"
+description: "Install reqstool (from PyPI or reqstool-client@main) and run reqstool validate --strict (spec completeness: every requirement has SVCs, manual SVCs have MVRs) against a reqstool data path. Must run after the repo's own build step, in the same job, since it depends on build-time artifacts (e.g. annotations.yml, test results). The 'validate' subcommand isn't on PyPI yet — until it ships in a release, only invoke this action for a 'main' leg."
+
+inputs:
+  reqstool-source:
+    description: "Where to install reqstool from: 'pypi' (latest release) or 'main' (reqstool-client@main)."
+    required: false
+    default: "pypi"
+  reqstool-path:
+    description: "Path to the reqstool data directory (containing requirements.yml etc.), relative to repo root."
+    required: false
+    default: "docs/reqstool"
+  python-version:
+    description: "Python version to use."
+    required: false
+    default: "3.13"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install reqstool
+      uses: ./.github/actions/install-reqstool
+      with:
+        reqstool-source: ${{ inputs.reqstool-source }}
+        python-version: ${{ inputs.python-version }}
+
+    - name: Run reqstool validate --strict
+      shell: bash
+      env:
+        REQSTOOL_PATH: ${{ inputs.reqstool-path }}
+      run: reqstool validate --strict local -p "$GITHUB_WORKSPACE/$REQSTOOL_PATH"