diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..b79603c
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout econ-skm-score via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl ca-certificates build-essential pkg-config libssl-dev git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2
diff --git a/module.wasm b/module.wasm
index edf544b..d459b08 100644
Binary files a/module.wasm and b/module.wasm differ
diff --git a/src/lib.rs b/src/lib.rs
index 3b25040..11a1e28 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -57,9 +57,7 @@ pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
 
     for d in &input.duties {
         if d.frequency < 0.0 || d.tariff_eur_per_hour < 0.0 || d.time_hours_per_case < 0.0 {
-            return Err(ModuleError::invalid_input(
-                "negative P/F/T/h not allowed",
-            ));
+            return Err(ModuleError::invalid_input("negative P/F/T/h not allowed"));
         }
         let value = d.population as f64
             * d.frequency as f64
@@ -84,7 +82,11 @@ pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
         total += value;
     }
 
-    let r = Report { items, total_eur_per_year: total, tier_lowest };
+    let r = Report {
+        items,
+        total_eur_per_year: total,
+        tier_lowest,
+    };
     Outputs::new().with_json("report", &r)
 }
 
@@ -97,11 +99,16 @@ fn lower_tier(a: &str, b: &str) -> String {
         "T3" => 3,
         _ => 4,
     };
-    if rank(b) > rank(a) { b.to_string() } else { a.to_string() }
+    if rank(b) > rank(a) {
+        b.to_string()
+    } else {
+        a.to_string()
+    }
 }
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
     use super::*;
 
     #[test]
@@ -155,6 +162,10 @@ mod tests {
                 tier: t,
             });
         }
-        Ok(Report { items, total_eur_per_year: total, tier_lowest: tier })
+        Ok(Report {
+            items,
+            total_eur_per_year: total,
+            tier_lowest: tier,
+        })
     }
 }