diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
new file mode 100644
index 0000000..646134d
--- /dev/null
+++ b/.tangled/workflows/ci.yml
@@ -0,0 +1,20 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - nix
+
+environment:
+  NIX_CONFIG: "experimental-features = nix-command flakes"
+
+steps:
+  - name: "Run checks"
+    command: |
+      set -euo pipefail
+      nix flake check
diff --git a/.tangled/workflows/update-flake-lock.yml b/.tangled/workflows/update-flake-lock.yml
new file mode 100644
index 0000000..39e7b22
--- /dev/null
+++ b/.tangled/workflows/update-flake-lock.yml
@@ -0,0 +1,31 @@
+when:
+  - event: ["manual"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - git
+    - nix
+
+environment:
+  NIX_CONFIG: "experimental-features = nix-command flakes"
+
+steps:
+  - name: "Update flake.lock"
+    command: |
+      set -euo pipefail
+
+      git config user.name "spindle"
+      git config user.email "spindle@zezura.xyz"
+
+      nix flake update
+
+      if git diff --quiet -- flake.lock; then
+        echo "flake.lock is already up to date"
+        exit 0
+      fi
+
+      git add flake.lock
+      git commit -m "flake.lock: update"
+      git push origin "HEAD:${TANGLED_REPO_DEFAULT_BRANCH:-main}"