diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..3d63df9
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout graph-citation-extract via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl ca-certificates build-essential pkg-config libssl-dev git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2
diff --git a/module.wasm b/module.wasm
index 185a950..68409ec 100644
Binary files a/module.wasm and b/module.wasm differ
diff --git a/src/lib.rs b/src/lib.rs
index 6f9ed7b..2b1a019 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -49,12 +49,11 @@ pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
         .require_json("norm")
         .map_err(|e| ModuleError::invalid_input(format!("norm shape: {e}")))?;
 
-    let re_para = Regex::new(r"§\s*(\d+[a-z]?)\s+([A-Z][A-Za-z0-9]+)")
-        .map_err(internal_re)?;
-    let re_art = Regex::new(r"Art(?:ikel|\.)\s*(\d+[a-z]?)\s+([A-Z][A-Za-z0-9]+)")
-        .map_err(internal_re)?;
-    let re_ivm = Regex::new(r"i\.\s?V\.\s?m\.\s+(?:§|Art\.?)\s*(\d+[a-z]?)")
-        .map_err(internal_re)?;
+    let re_para = Regex::new(r"§\s*(\d+[a-z]?)\s+([A-Z][A-Za-z0-9]+)").map_err(internal_re)?;
+    let re_art =
+        Regex::new(r"Art(?:ikel|\.)\s*(\d+[a-z]?)\s+([A-Z][A-Za-z0-9]+)").map_err(internal_re)?;
+    let re_ivm =
+        Regex::new(r"i\.\s?V\.\s?m\.\s+(?:§|Art\.?)\s*(\d+[a-z]?)").map_err(internal_re)?;
 
     let from_eli = norm.eli.unwrap_or_else(|| "eli/?".into());
     let mut citations = Vec::new();
@@ -93,7 +92,10 @@ pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
         }
     }
 
-    let out = Output { from: from_eli, citations };
+    let out = Output {
+        from: from_eli,
+        citations,
+    };
     Outputs::new().with_json("citations", &out)
 }
 
@@ -103,6 +105,7 @@ fn internal_re<E: core::fmt::Display>(e: E) -> ModuleError {
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
     use super::*;
     use regex::Regex;
 
@@ -114,20 +117,31 @@ mod tests {
         for p in &norm.paragraphs {
             for c in re_para.captures_iter(&p.text) {
                 cs.push(Citation {
-                    to: format!("eli/bund/{}/{}", c[2].to_ascii_lowercase(), c[1].to_ascii_lowercase()),
+                    to: format!(
+                        "eli/bund/{}/{}",
+                        c[2].to_ascii_lowercase(),
+                        c[1].to_ascii_lowercase()
+                    ),
                     kind: "cites",
                     raw: c[0].to_string(),
                 });
             }
             for c in re_art.captures_iter(&p.text) {
                 cs.push(Citation {
-                    to: format!("eli/eu/{}/art{}", c[2].to_ascii_lowercase(), c[1].to_ascii_lowercase()),
+                    to: format!(
+                        "eli/eu/{}/art{}",
+                        c[2].to_ascii_lowercase(),
+                        c[1].to_ascii_lowercase()
+                    ),
                     kind: "cites",
                     raw: c[0].to_string(),
                 });
             }
         }
-        Output { from: norm.eli.unwrap_or_default(), citations: cs }
+        Output {
+            from: norm.eli.unwrap_or_default(),
+            citations: cs,
+        }
     }
 
     #[test]