diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..333c5c1
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,74 @@
+name: ci
+
+# Smoke test the testbed on every push and pull request: stand up a
+# single-node GreptimeDB (standalone-fs) using the LATEST greptimedb release
+# binary and assert that SQL works (a write that round-trips through the
+# client port).
+on:
+  push:
+  pull_request:
+
+# Cancel a superseded run on the same ref.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  smoke:
+    name: standalone-fs smoke (latest greptimedb release)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Nix (with flake support)
+        uses: DeterminateSystems/nix-installer-action@v22
+
+      - name: Cache Nix builds
+        # Zero-config cache for public repos; speeds up the `nix develop`
+        # devShell build across runs.
+        uses: DeterminateSystems/magic-nix-cache-action@v14
+
+      - name: Download latest GreptimeDB release binary
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          auth=()
+          [ -n "${GH_TOKEN:-}" ] && auth=(-H "Authorization: Bearer $GH_TOKEN")
+          # Pick the GNU linux-amd64 tarball (skip the centos variant).
+          url="$(curl -fsSL "${auth[@]}" \
+            https://api.github.com/repos/GreptimeTeam/greptimedb/releases/latest \
+            | grep -oE 'https://[^"]+greptime-linux-amd64-v[0-9][^"]*\.tar\.gz' \
+            | grep -v centos | head -n1)"
+          echo "Latest release asset: $url"
+          curl -fsSL -o /tmp/greptime.tgz "$url"
+          mkdir -p /tmp/greptime-extract
+          tar xzf /tmp/greptime.tgz -C /tmp/greptime-extract
+          bin="$(find /tmp/greptime-extract -type f -name greptime | head -n1)"
+          install -m 0755 "$bin" ./greptime
+          ./greptime --version
+
+      - name: Temporarily strip unreleased iceberg_manifest plugin from config
+        # config/standalone-fs.toml enables the `iceberg_manifest` plugin, which
+        # is newer than the latest greptimedb release (the release hard-fails on
+        # unknown plugin variants). Once the greptimedb patch to tolerate
+        # unknown plugin options lands, DELETE THIS STEP and the config will
+        # work against the release as-is.
+        run: |
+          sed -i -e '/^\[\[plugins\]\]$/d' -e '/^iceberg_manifest[[:space:]]*=/d' \
+            config/standalone-fs.toml
+          echo "Stripped iceberg_manifest plugin block from config/standalone-fs.toml"
+
+      - name: Start standalone-fs and run a SQL smoke test
+        run: nix develop --command bash ci/smoke.sh
+
+      - name: Dump standalone-fs logs on failure
+        if: failure()
+        run: |
+          nix develop --command bash -c 'process-compose process list || true'
+          nix develop --command bash -c 'process-compose process logs standalone-fs --tail 200 || true' || true
+
+      - name: Tear down
+        if: always()
+        run: nix develop --command bash -c 'process-compose down || true' || true
diff --git a/ci/smoke.sh b/ci/smoke.sh
new file mode 100755
index 0000000..c8edd78
--- /dev/null
+++ b/ci/smoke.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# CI smoke test for the testbed.
+#
+# Starts the single-node standalone-fs server (local File backend — no
+# garage/etcd needed) and asserts that at least one SQL statement works
+# (a write that round-trips through the client port).
+#
+# Run inside `nix develop` (which provides process-compose, psql and curl):
+#
+#   nix develop --command bash ci/smoke.sh
+#
+# Expects a `greptime` binary at the project root (GREPTIME_BIN default),
+# e.g. downloaded from the latest GreptimeTeam/greptimedb release.
+#
+# NOTE: this script intentionally does NOT tear the server down on exit — the
+# caller (CI workflow) fetches logs on failure and tears down in a later step.
+set -euo pipefail
+
+HEALTH_WAIT_SECS="${HEALTH_WAIT_SECS:-120}"
+
+echo "==> starting standalone-fs (single-node, local File backend)"
+process-compose --tui=false up --detached standalone-fs
+
+echo "==> waiting for client HTTP port 11040 to become healthy (up to ${HEALTH_WAIT_SECS}s)"
+healthy=0
+for i in $(seq 1 "$HEALTH_WAIT_SECS"); do
+  if curl -sf http://127.0.0.1:11040/health >/dev/null; then
+    echo "    GreptimeDB healthy after ${i}s"
+    healthy=1
+    break
+  fi
+  sleep 1
+done
+if [ "$healthy" != 1 ]; then
+  echo "ERROR: GreptimeDB did not become healthy on port 11040" >&2
+  exit 1
+fi
+
+echo "==> write a row via testbedctl (client PostgreSQL port 11043)"
+./testbedctl psql -q -v ON_ERROR_STOP=1 \
+  -c "CREATE TABLE IF NOT EXISTS ci_smoke (ts TIMESTAMP TIME INDEX, v INT);" \
+  -c "INSERT INTO ci_smoke VALUES (now(), 42);"
+
+echo "==> read it back"
+val="$(./testbedctl psql -t -A -v ON_ERROR_STOP=1 \
+  -c "SELECT v FROM ci_smoke ORDER BY ts DESC LIMIT 1;")"
+echo "    read-back value: ${val:-<empty>}"
+if [ "${val:-}" != "42" ]; then
+  echo "ERROR: expected SQL to return 42, got '${val:-}'" >&2
+  exit 1
+fi
+
+echo "==> SMOKE TEST PASSED"