diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..3714057
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,196 @@
+name: Build
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        board: [hi3518ev200, hi3516cv200]
+
+    steps:
+      - name: Install 32-bit libs
+        run: |
+          sudo dpkg --add-architecture i386
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq zlib1g:i386 libc6:i386 libstdc++6:i386
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache toolchain
+        id: cache-tc
+        uses: actions/cache@v4
+        with:
+          path: toolchain
+          key: arm-hisiv510-linux-v1
+
+      - name: Download toolchain
+        if: steps.cache-tc.outputs.cache-hit != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download v1 -R OpenIPC/toolchains \
+            -p 'arm-hisiv510-linux.tgz'
+          mkdir -p toolchain
+          tar xzf arm-hisiv510-linux.tgz -C toolchain
+          if [ -f toolchain/arm-hisiv510-linux/arm-hisiv510-linux.tar.bz2 ]; then
+            tar xjf toolchain/arm-hisiv510-linux/arm-hisiv510-linux.tar.bz2 -C toolchain
+          fi
+          rm arm-hisiv510-linux.tgz
+          # Create short-name symlinks (target/bin/ has absolute symlinks that won't work)
+          cd toolchain/arm-hisiv510-linux/bin
+          for f in arm-hisiv510-linux-uclibcgnueabi-*; do
+            ln -sf "$f" "${f/-uclibcgnueabi/}"
+          done
+
+      - name: Build
+        run: |
+          export PATH="$PWD/toolchain/arm-hisiv510-linux/bin:$PATH"
+          make ${{ matrix.board }}_config
+          cp reg_info_${{ matrix.board }}.bin .reg
+          make CROSS_COMPILE=arm-hisiv510-linux- -j$(nproc)
+          make CROSS_COMPILE=arm-hisiv510-linux- mini-boot.bin
+          cp mini-boot.bin u-boot-${{ matrix.board }}-universal.bin
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: u-boot-${{ matrix.board }}-universal
+          path: u-boot-${{ matrix.board }}-universal.bin
+
+  # QEMU smoke test — gates publish on actually-bootable binaries.
+  # Boots the freshly-built u-boot in widgetii/qemu-hisilicon's
+  # machine model at the default RAM and asserts it prints past the
+  # legacy "System startup" banner.
+  qemu_smoke:
+    needs: build
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Both binaries target V2-generation Hi3516CV200/Hi3518EV200
+        # silicon (ARM926EJ-S); widgetii/qemu-hisilicon's
+        # `hi3516cv200` machine emulates that family. There is no
+        # standalone `hi3518ev200` machine — the binary boots fine in
+        # the cv200 model since they share the SoC.
+        include:
+          - { board: hi3518ev200, machine: hi3516cv200 }
+          - { board: hi3516cv200, machine: hi3516cv200 }
+    steps:
+      - name: Install QEMU build deps
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq --no-install-recommends \
+            build-essential ninja-build meson pkg-config \
+            libglib2.0-dev libpixman-1-dev libfdt-dev zlib1g-dev \
+            libslirp-dev python3 python3-venv
+
+      - name: Resolve qemu-hisilicon HEAD
+        id: qemu-rev
+        run: |
+          sha=$(git ls-remote https://github.com/widgetii/qemu-hisilicon master | cut -f1)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+
+      - name: Cache qemu-system-arm
+        id: cache-qemu
+        uses: actions/cache@v4
+        with:
+          path: qemu-arm
+          key: qemu-hisilicon-${{ steps.qemu-rev.outputs.sha }}
+
+      - name: Build qemu-system-arm (cache miss)
+        if: steps.cache-qemu.outputs.cache-hit != 'true'
+        run: |
+          git clone --depth 1 --branch master \
+            https://github.com/widgetii/qemu-hisilicon qemu-hisilicon
+          cd qemu-hisilicon
+          bash qemu/setup.sh
+          cp qemu-src/build/qemu-system-arm "$GITHUB_WORKSPACE/qemu-arm"
+          chmod +x "$GITHUB_WORKSPACE/qemu-arm"
+
+      - name: Download u-boot artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: u-boot-${{ matrix.board }}-universal
+
+      - name: Smoke-test in QEMU
+        timeout-minutes: 2
+        run: |
+          UBOOT="$PWD/u-boot-${{ matrix.board }}-universal.bin"
+          test -f "$UBOOT"
+          dd if=/dev/zero of=/tmp/flash.bin bs=1M count=8 2>/dev/null
+          dd if="$UBOOT" of=/tmp/flash.bin bs=1 conv=notrunc 2>/dev/null
+          mkfifo /tmp/uart.in /tmp/uart.out
+          chmod +x ./qemu-arm
+          ./qemu-arm \
+            -M ${{ matrix.machine }} \
+            -global hisi-fmc.flash-file=/tmp/flash.bin \
+            -nographic -serial pipe:/tmp/uart \
+            -monitor none > /tmp/qemu.log 2>&1 &
+          QEMU_PID=$!
+          timeout 10 cat /tmp/uart.out > /tmp/uboot.txt || true
+          kill "$QEMU_PID" 2>/dev/null || true
+          wait 2>/dev/null || true
+          echo "== captured u-boot output =="
+          cat /tmp/uboot.txt
+          echo
+          if grep -qE 'U-Boot |Hit any key|CPU:|DRAM:|Board:' /tmp/uboot.txt; then
+            echo "PASS: u-boot booted past System startup"
+          else
+            echo "FAIL: u-boot did not get past System startup"
+            echo
+            echo "== qemu stderr =="
+            tail -40 /tmp/qemu.log || true
+            exit 1
+          fi
+
+  # Publish job — common failure modes:
+  #   "GH_TOKEN environment variable required" / empty token: secret
+  #     FIRMWARE_RELEASE_TOKEN is missing or unreadable. Set via the
+  #     org-level Actions secret on OpenIPC.
+  #   401 Bad credentials: PAT expired (fine-grained max is 1 year) or
+  #     revoked. Mint a new fine-grained PAT and update the secret.
+  #   403 Forbidden: PAT lacks Contents:write on OpenIPC/firmware, or
+  #     its repo selector doesn't include OpenIPC/firmware.
+  #   404 on `gh release upload latest`: the `latest` tag was deleted in
+  #     OpenIPC/firmware. Recreate it before retrying.
+  publish:
+    needs: [build, qemu_smoke]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Upload to OpenIPC/firmware latest release
+        env:
+          GH_TOKEN: ${{ secrets.FIRMWARE_RELEASE_TOKEN }}
+        run: |
+          set -eu
+          # Releases API occasionally returns 502/503 ("Unicorn!"). Retry
+          # with linear backoff: 10s, 20s, 30s, 40s — total ~100s.
+          upload() {
+            local f="$1" i
+            for i in 1 2 3 4 5; do
+              if gh release upload latest "$f" --clobber -R OpenIPC/firmware; then
+                return 0
+              fi
+              [ "$i" = "5" ] && return 1
+              echo "upload attempt $i failed; sleeping $((i*10))s" >&2
+              sleep $((i*10))
+            done
+          }
+          for soc in hi3518ev200 hi3516cv200; do
+            f="artifacts/u-boot-${soc}-universal/u-boot-${soc}-universal.bin"
+            test -f "$f"
+            upload "$f"
+          done
diff --git a/arch/arm/cpu/hi3518ev200/config.mk b/arch/arm/cpu/hi3518ev200/config.mk
index 65c3b77..0e4ec42 100644
--- a/arch/arm/cpu/hi3518ev200/config.mk
+++ b/arch/arm/cpu/hi3518ev200/config.mk
@@ -23,7 +23,8 @@
 PLATFORM_RELFLAGS += -fno-strict-aliasing -fno-common -ffixed-r8
 #		     -msoft-float
 
-# Make ARMv5 to allow more compilers to work, even though its v7a.
+# Hi3518EV200 / Hi3516CV200 are ARM926EJ-S (ARMv5TEJ), per the QEMU
+# machine model in widgetii/qemu-hisilicon. Stay on armv5te to match.
 PLATFORM_RELFLAGS += -fno-aggressive-loop-optimizations
 PLATFORM_CPPFLAGS += -march=armv5te
 PLATFORM_CPPFLAGS += -mno-unaligned-access