diff --git a/.github/workflows/ci.yml b/.github/workflows/pull-request-checks.yml
similarity index 87%
rename from .github/workflows/ci.yml
rename to .github/workflows/pull-request-checks.yml
index e2e90f7..14cacb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -1,13 +1,8 @@
-name: 🔁 CI
+name: 🧪 Pull request checks
 
 on:
   pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
 
-# `pull_request` already covers branch pushes; `branches: ['**']` ran every
-# PR commit twice.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/sanity-check.yml b/.github/workflows/sanity-check.yml
new file mode 100644
index 0000000..4e8e6ac
--- /dev/null
+++ b/.github/workflows/sanity-check.yml
@@ -0,0 +1,49 @@
+name: ✅ Sanity check
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  BUN_VERSION: 1.4.0
+
+jobs:
+  sanity-check:
+    name: 🩺 Sanity check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@v4
+
+      - name: 🥟 Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: ♻️ Restore dependency cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: ${{ runner.os }}-bun-
+
+      - name: 📦 Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: 🚦 Full check
+        run: bun run system-check
+
+      - name: 🎉 All clear
+        run: echo "✅ ${GITHUB_SHA:0:7} landed on \`main\` clean — format, types, lint, tests, and build all green." >> "$GITHUB_STEP_SUMMARY"
+
+      - name: 🚨 Something broke
+        if: failure()
+        run: echo "💥 ${GITHUB_SHA:0:7} broke \`main\` — check the failed step above." >> "$GITHUB_STEP_SUMMARY"