diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..28ffb0c
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout text-akoma-normalize via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl ca-certificates build-essential pkg-config libssl-dev git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2
diff --git a/module.wasm b/module.wasm
index 12e27d3..0905472 100644
Binary files a/module.wasm and b/module.wasm differ
diff --git a/src/lib.rs b/src/lib.rs
index a9642c4..d816671 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -75,11 +75,10 @@ struct Paragraph {
 #[fai_module]
 pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
     let bytes = inputs.require_bytes("content")?;
-    let mime_hint_lower: Option<String> =
-        inputs.get("mime").and_then(|p| match p {
-            Payload::Text(s) => Some(s.to_ascii_lowercase()),
-            _ => None,
-        });
+    let mime_hint_lower: Option<String> = inputs.get("mime").and_then(|p| match p {
+        Payload::Text(s) => Some(s.to_ascii_lowercase()),
+        _ => None,
+    });
 
     let mime = mime_hint_lower
         .or_else(|| sniff_mime(&bytes.data))
@@ -206,7 +205,10 @@ fn split_paragraphs(text: &str) -> Vec<Paragraph> {
         return Vec::new();
     }
     let mut out: Vec<Paragraph> = Vec::new();
-    let mut current = Paragraph { number: String::new(), text: String::new() };
+    let mut current = Paragraph {
+        number: String::new(),
+        text: String::new(),
+    };
     for line in text.lines() {
         let line = line.trim();
         if line.is_empty() {
@@ -216,7 +218,10 @@ fn split_paragraphs(text: &str) -> Vec<Paragraph> {
             if !current.text.is_empty() {
                 out.push(core::mem::replace(
                     &mut current,
-                    Paragraph { number: String::new(), text: String::new() },
+                    Paragraph {
+                        number: String::new(),
+                        text: String::new(),
+                    },
                 ));
             }
             current.number = num.to_string();
@@ -242,7 +247,7 @@ fn leading_paragraph_marker(line: &str) -> Option<&str> {
         return None;
     }
     let close = bytes.iter().position(|&b| b == b')')?;
-    if close < 2 || close > 5 {
+    if !(2..=5).contains(&close) {
         return None;
     }
     let inner = line.get(1..close)?;
@@ -299,6 +304,7 @@ fn xml_err<E: core::fmt::Display>(e: E) -> ModuleError {
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
     use super::*;
 
     const SAMPLE_GEWO_14: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
@@ -332,7 +338,11 @@ mod tests {
         let norm = normalize_gii_xml(SAMPLE_GEWO_14.as_bytes()).expect("parse ok");
         assert_eq!(norm.paragraphs.len(), 2);
         assert_eq!(norm.paragraphs[0].number, "(1)");
-        assert!(norm.paragraphs[0].text.starts_with("Wer den selbstständigen"));
+        assert!(
+            norm.paragraphs[0]
+                .text
+                .starts_with("Wer den selbstständigen")
+        );
         assert_eq!(norm.paragraphs[1].number, "(2)");
     }
 
@@ -351,7 +361,10 @@ mod tests {
             sniff_mime(b"<?xml version=\"1.0\"?><dokumente>"),
             Some("application/xml".into())
         );
-        assert_eq!(sniff_mime(b"<dokumente><norm/>"), Some("application/xml".into()));
+        assert_eq!(
+            sniff_mime(b"<dokumente><norm/>"),
+            Some("application/xml".into())
+        );
         assert_eq!(sniff_mime(b"%PDF-1.4 ..."), None);
     }
 }