diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..0cef4fa
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,34 @@
+name: Tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  unittest:
+    name: Unit tests
+    runs-on: ubuntu-latest
+
+    steps:
+      # Pinned to immutable commit SHAs (not @v4 / @v5) so a compromised tag
+      # cannot silently swap the underlying action code on this CI runner.
+      # When bumping, verify the new SHA via:
+      #   gh api repos/actions/<name>/git/ref/tags/<vN> --jq '.object.sha'
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: '3.12'
+
+      - name: Install runtime + test dependencies
+        # Only what the tests actually exercise. `pywebview` from requirements.txt
+        # is the desktop-launcher dep and pulls GTK / Qt system packages on Linux
+        # — out of scope for the unittest suite, so it's deliberately omitted here.
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install 'flask>=3.0' 'fpdf2>=2.7'
+
+      - name: Run unittest suite
+        run: python -m unittest discover tests -v