diff --git a/.golangci.toml b/.golangci.toml
index 9a49ff8..bd0d27e 100644
--- a/.golangci.toml
+++ b/.golangci.toml
@@ -23,14 +23,11 @@ path = "internal/mcp/"
 linters = ["nilerr"]
 
 [formatters]
-enable = ["goimports", "gofumpt", "gci", "golines"]
+enable = ["goimports", "gci", "golines"]
 
 [formatters.settings.goimports]
 local-prefixes = ["secluded.site/lune"]
 
-[formatters.settings.gofumpt]
-module-path = "secluded.site/lune"
-
 [formatters.settings.gci]
 sections = ["standard", "default", "localmodule"]
 
diff --git a/.tangled/workflows/check.yml b/.tangled/workflows/check.yml
new file mode 100644
index 0000000..fc80390
--- /dev/null
+++ b/.tangled/workflows/check.yml
@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: Amolith <amolith@secluded.site>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+when:
+  - event: ["push"]
+    branch: ["**"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: microvm
+image: alpine
+
+steps:
+  - name: Install check dependencies
+    environment:
+      LUNE_RELEASE: ""
+    command: |
+      set -eu
+      apk add --no-cache \
+        build-base \
+        ca-certificates \
+        git \
+        mise@edge-community
+
+      mise trust mise.toml
+      mise install
+
+  - name: Run checks
+    environment:
+      LUNE_RELEASE: ""
+    command: mise run ci
diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index a9aaff6..b416567 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -15,13 +15,15 @@ clone:
 
 environment:
   LUNE_RELEASE_APP_PASSWORD_FILE: /tmp/lune-release-app-password
-  MISE_DISABLE_TOOLS: go:golang.org/x/vuln/cmd/govulncheck,golangci-lint,pipx:reuse
 
 steps:
   - name: Install release dependencies
+    environment:
+      LUNE_RELEASE: ""
     command: |
       set -eu
       apk add --no-cache \
+        build-base \
         ca-certificates \
         coreutils \
         curl \
@@ -33,6 +35,11 @@ steps:
       mise trust mise.toml
       mise install
 
+  - name: Run checks
+    environment:
+      LUNE_RELEASE: ""
+    command: mise run ci
+
   - name: Publish release
     command: |
       set -eu
diff --git a/AGENTS.md.license b/AGENTS.md.license
new file mode 100644
index 0000000..3dbb1e2
--- /dev/null
+++ b/AGENTS.md.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: Amolith <amolith@secluded.site>
+
+SPDX-License-Identifier: CC0-1.0
diff --git a/mise.toml b/mise.toml
index a6712a0..74d6d0a 100644
--- a/mise.toml
+++ b/mise.toml
@@ -17,23 +17,40 @@ go = "1.25"
 golangci-lint = "latest"
 "pipx:reuse" = "latest"
 upx = "latest"
+uv = "latest"
 
 [tasks.fmt]
 description = "Format Go code"
 run = "golangci-lint fmt"
 
+[tasks."fmt:check"]
+description = "Check Go formatting"
+run = "golangci-lint fmt --diff"
+
 [tasks.tidy]
 description = "Tidy go.mod and go.sum"
 run = "go mod tidy"
 
+[tasks."tidy:check"]
+description = "Check that go.mod and go.sum are tidy"
+run = "go mod tidy -diff"
+
 [tasks.modernize]
 description = "Apply Go modernization fixes"
 run = "golangci-lint run --enable-only modernize --fix ./..."
 
+[tasks."modernize:check"]
+description = "Check Go modernization opportunities"
+run = "golangci-lint run --enable-only modernize ./..."
+
 [tasks.lint]
 description = "Lint Go code and apply safe fixes"
 run = "golangci-lint run --fix"
 
+[tasks."lint:check"]
+description = "Lint Go code without modifying it"
+run = "golangci-lint run"
+
 [tasks.fix]
 description = "Format, modernize, and apply lint fixes"
 run = ["mise run fmt", "mise run modernize", "mise run lint"]
@@ -63,6 +80,19 @@ go build \
   {{vars.main}}
 '''
 
+[tasks."build:check"]
+description = "Check the production build without writing a binary"
+env = { CGO_ENABLED = "0" }
+run = '''
+version=$(git describe --tags --always 2>/dev/null || printf dev)
+go build \
+  -trimpath \
+  -tags '{{vars.static_tags}}' \
+  -ldflags '{{vars.static_ldflags}} -X main.version='"$version" \
+  -o /dev/null \
+  {{vars.main}}
+'''
+
 [tasks.install]
 description = "Install a static pure-Go lune binary"
 env = { CGO_ENABLED = "0" }
@@ -115,6 +145,20 @@ run = "rm -rf lune dist/"
 description = "Remove build artifacts and local configuration"
 run = "rm -rf lune dist/ config.toml"
 
+[tasks.ci]
+description = "Run non-mutating continuous integration checks"
+run = [
+  "mise run fmt:check",
+  "mise run tidy:check",
+  "mise run modernize:check",
+  "mise run lint:check",
+  "mise run vet",
+  "mise run vuln",
+  "mise run reuse",
+  "mise run build:check",
+  "mise run test:quiet",
+]
+
 [tasks.check]
 description = "Format, tidy, lint, scan, build, and test"
 run = [