diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d16ec68
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI: "true"
+  FORCE_COLOR: "1"
+
+jobs:
+  ci:
+    name: Rust checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Activate Hermit
+        uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+        with:
+          cache: "true"
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: . -> target
+
+      - name: Run repository CI
+        run: just ci
+
+      - name: Run isolated Docker acceptance tests
+        run: just bl-cli-docker-acceptance
diff --git a/Cargo.toml b/Cargo.toml
index dbf1b03..643274f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,3 +1,7 @@
+[workspace]
+members = ["crates/builderlab-auth"]
+resolver = "2"
+
 [package]
 name = "sq-kgoose"
 version = "0.7.12"
diff --git a/Justfile b/Justfile
index b725f13..3219e0d 100644
--- a/Justfile
+++ b/Justfile
@@ -27,7 +27,12 @@ protos:
 
   # Download all protos without transitive deps (-i) to avoid pulling in
   # ~250 arcade/UI/franklin protos via client_renderable.proto
-  bin/schema-registry get --save-to=protos -i \
+  if ! command -v schema-registry >/dev/null 2>&1; then
+    echo "schema-registry is not a public Hermit package; install the internal CLI separately to refresh protos." >&2
+    exit 1
+  fi
+
+  schema-registry get --save-to=protos -i \
     google/api/annotations.proto \
     google/api/http.proto \
     squareup/cash/kgoose/api/v3/tool_endpoint_service.proto \
@@ -101,13 +106,15 @@ fmt-check:
   cargo fmt --all -- --check
 
 lint: fmt-check
-  cargo clippy --locked --all-targets --all-features -- -D warnings
+  cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
 
 test:
-  cargo test --locked --all-features
+  cargo test --locked --workspace --all-features
 
 package-smoke: build-sq
   ./sqbin/{{BIN_NAME}}.exoskeleton --version
+  ./target/release/bl --version
+  ./target/release/bl --help
 
 # Build and run the isolated, deterministic Docker acceptance harness for bl skills.
 bl-cli-docker-acceptance:
diff --git a/bin/.schema-registry-0.127.1.pkg b/bin/.schema-registry-0.127.1.pkg
deleted file mode 120000
index 383f451..0000000
--- a/bin/.schema-registry-0.127.1.pkg
+++ /dev/null
@@ -1 +0,0 @@
-hermit
\ No newline at end of file
diff --git a/bin/hermit.hcl b/bin/hermit.hcl
index cc17d79..85c8ffb 100644
--- a/bin/hermit.hcl
+++ b/bin/hermit.hcl
@@ -1,4 +1,2 @@
-manage-git = false
-
-github-token-auth {
-}
+sources = ["https://github.com/cashapp/hermit-packages.git"]
+manage-git = true
diff --git a/bin/schema-registry b/bin/schema-registry
deleted file mode 120000
index 8b5fe99..0000000
--- a/bin/schema-registry
+++ /dev/null
@@ -1 +0,0 @@
-.schema-registry-0.127.1.pkg
\ No newline at end of file