diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f0b4c961..23e34d37 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -125,3 +125,47 @@ jobs:
 
       - name: Run PHPStan
         run: vendor/bin/phpstan analyse
+
+  mutation-testing:
+    name: Mutation Testing
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2
+        with:
+          php-version: '8.2'
+          extensions: json
+          coverage: xdebug
+          tools: composer:v2
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer update -n --prefer-dist
+
+      - name: Download Infection PHAR
+        run: |
+          wget https://github.com/infection/infection/releases/download/0.30.0/infection.phar
+          wget https://github.com/infection/infection/releases/download/0.30.0/infection.phar.asc
+
+      - name: Validate Infection PHAR
+        run: |
+          gpg --keyserver hkps://keys.openpgp.org --recv-keys C6D76C329EBADE2FB9C458CFC5095986493B4AA0
+          gpg --with-fingerprint --verify infection.phar.asc infection.phar
+          chmod +x infection.phar
+
+      - name: Run mutation testing
+        run: ./infection.phar --threads=max --min-msi=87 --min-covered-msi=87