diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..55a94fd
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,82 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  # Allow running the suite by hand, e.g. to sanity-check before tagging a release.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  # Supersede in-flight runs for the same branch/PR; a stale run has nothing to say.
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          # Honor the toolchain pinned in go.mod rather than drifting with
+          # whatever "stable" happens to mean on release day.
+          go-version-file: go.mod
+          cache: true
+
+      - name: Verify gofmt
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "::error::These files are not gofmt'd:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Verify go.mod is tidy
+        run: |
+          go mod tidy
+          if ! git diff --quiet -- go.mod go.sum; then
+            echo "::error::go.mod/go.sum are out of date — run 'go mod tidy' and commit the result."
+            git diff -- go.mod go.sum
+            exit 1
+          fi
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      # The View layer is testable without a TTY, so the whole suite runs
+      # headless. -race catches the async tea.Cmd paths (status/ping polling).
+      - name: Test
+        run: go test -race ./...
+
+  # Catch .goreleaser.yaml errors here rather than on a tag push, where the
+  # only symptom is a failed release job after the tag already exists.
+  goreleaser-config:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Check GoReleaser config
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: check
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957e519..40fe4da 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -13,13 +13,13 @@ builds:
       - amd64
       - arm64
     ldflags:
-      - -X main.version={{.Version}} -s -w -extldflags "{{.Env.LDFLAGS}}"
+      - -X main.version={{.Version}} -s -w
 
 archives:
-  - format: tar.gz
+  - formats: [tar.gz]
     name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
 
-# nfpm genererer officielle .deb (Debian/Ubuntu) og .rpm (Fedora/RedHat) pakker
+# nfpm builds official .deb (Debian/Ubuntu) and .rpm (Fedora/RedHat) packages
 nfpms:
   - id: tailtui-packages
     homepage: https://github.com/Phundahl/tailtui
@@ -32,7 +32,7 @@ nfpms:
     dependencies:
       - tailscale
     bindir: /usr/bin
-    files:
+    contents:
       - src: LICENSE
         dst: /usr/share/licenses/tailtui/LICENSE
 
@@ -40,7 +40,7 @@ checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  name_template: "{{ .Version }}-snapshot"
+  version_template: "{{ .Version }}-snapshot"
 
 changelog:
   sort: asc