diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..9fe327f
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  nix-build:
+    runs-on: "${{ matrix.os }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          # not supported by the flake atm
+          #- ubuntu-22.04-arm
+          #- macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v31
+      - uses: cachix/cachix-action@v16
+        with:
+          name: nixos-infra-dev
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+      - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom
diff --git a/flake.lock b/flake.lock
index 8016a76..da2a406 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1717667611,
-        "narHash": "sha256-MA50QcNTCV3AUc+0RtyhHcYMAZ81ZkVypm/lHUq5BP0=",
+        "lastModified": 1735651292,
+        "narHash": "sha256-YLbzcBtYo1/FEzFsB3AnM16qFc6fWPMIoOuSoDwvg9g=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d1930fa7524da1d320d00eecba84e81810477f3a",
+        "rev": "0da3c44a9460a26d2025ec3ed2ec60a895eb1114",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 381ec58..d599d63 100644
--- a/flake.nix
+++ b/flake.nix
@@ -66,9 +66,11 @@
 
       };
 
-      defaultPackage.x86_64-linux = (import nixpkgs {
+      packages.default.x86_64-linux = (import nixpkgs {
         system = "x86_64-linux";
         overlays = [ self.overlays.default ];
       }).nixos-channel-scripts;
+
+      checks.x86_64-linux.default = self.packages.default.x86_64-linux;
     };
 }
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..723c931
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base", ":dependencyDashboard"],
+  "nix": {
+    "enabled": true
+  },
+  "lockFileMaintenance": { "enabled": true }
+}