diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..a69e6f2
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,22 @@
+name: Check
+
+on:
+  pull_request:
+  push:
+    branches: [ori]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: macos-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      # The tests expect the full toolkit, as the README's `mise install` sets it up.
+      - uses: jdx/mise-action@v2
+        with:
+          cache: true
+      - run: mise run check
diff --git a/tests/test_project_toolchains.py b/tests/test_project_toolchains.py
index 5ae3134..e18065a 100644
--- a/tests/test_project_toolchains.py
+++ b/tests/test_project_toolchains.py
@@ -1,6 +1,8 @@
 import json
+import os
 from pathlib import Path
 import shutil
+import subprocess
 import tempfile
 import tomllib
 import unittest
@@ -154,6 +156,8 @@ def test_real_mise_lookup_leaves_temporary_home_unchanged(self):
         binary = self.home / 'test-bin/mise'
         binary.unlink()
         binary.symlink_to(mise)
+        # mise records a one-time migration in its own data directory on first run; warm it so only setup's writes count.
+        subprocess.run([mise, '--no-config', 'where', 'java'], env=self.env, capture_output=True)
         before = self.snapshot()
         result = self.run_step('diff')
         self.assertIn('java@21 maven@latest', result.stdout)