diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
new file mode 100644
index 0000000..c4c391a
--- /dev/null
+++ b/.tangled/workflows/ci.yml
@@ -0,0 +1,28 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - nodejs_24
+    - pnpm
+    # pnpm's node_modules/.bin shims are shell scripts needing sed/dirname/uname
+    - gnused
+    - coreutils
+
+steps:
+  - name: "Install dependencies"
+    command: pnpm install --frozen-lockfile
+
+  - name: "Lint"
+    command: pnpm lint
+
+  - name: "Check formatting"
+    command: pnpm format
+
+  - name: "Unit tests"
+    command: pnpm test:unit run
diff --git a/.tangled/workflows/e2e.yml b/.tangled/workflows/e2e.yml
new file mode 100644
index 0000000..7351f9d
--- /dev/null
+++ b/.tangled/workflows/e2e.yml
@@ -0,0 +1,42 @@
+# Playwright browsers come from nixpkgs (playwright-driver.browsers), pre-patched
+# for NixOS — `playwright install` binaries don't run there. Playwright locates
+# browsers by exact revision, so @playwright/test in package.json is pinned to the
+# version nixpkgs ships (currently 1.61.1). Bump both in lockstep.
+
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: microvm
+image: nixos
+
+# Pin to the nixpkgs rev the playwright pin was verified against
+registry:
+  nixpkgs: github:nixos/nixpkgs/nixos-unstable
+
+dependencies:
+  - nodejs_24
+  - pnpm
+  - playwright-driver.browsers
+
+environment:
+  # Skip Playwright's Linux-distro package checks; deps are provided by Nix
+  PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS: "true"
+  # Unsupported-platform fallback pretends to be Ubuntu; use a modern target for webkit
+  PLAYWRIGHT_HOST_PLATFORM_OVERRIDE: "ubuntu-24.04"
+
+steps:
+  - name: "Install dependencies"
+    command: pnpm install --frozen-lockfile
+
+  - name: "Build"
+    command: pnpm build
+
+  # webkit is skipped in CI: WPE WebKit hangs without a host GL stack, which the
+  # headless microVM doesn't provide. Run the full matrix locally with `pnpm test:e2e`.
+  - name: "E2E tests"
+    command: |
+      export PLAYWRIGHT_BROWSERS_PATH="$(ls -d /nix/store/*-playwright-browsers | head -n1)"
+      pnpm test:e2e --project=chromium --project=firefox
diff --git a/package.json b/package.json
index a9ff83c..3900814 100644
--- a/package.json
+++ b/package.json
@@ -11,10 +11,10 @@
     "test:e2e": "playwright test",
     "build-only": "vite build",
     "type-check": "vue-tsc --build",
-    "lint": "run-s \"lint:*\"",
-    "lint:oxlint": "oxlint . --fix",
-    "lint:eslint": "eslint . --fix --cache",
-    "format": "oxfmt src/"
+    "lint": "oxlint . && eslint . --cache",
+    "lint:fix": "oxlint . --fix && eslint . --fix --cache",
+    "format": "oxfmt --check src/",
+    "format:fix": "oxfmt src/"
   },
   "dependencies": {
     "pinia": "^4.0.2",
@@ -22,7 +22,7 @@
     "vue-router": "^5.2.0"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.1",
+    "@playwright/test": "1.61.1",
     "@tsconfig/node24": "^24.0.4",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^24.13.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5ae84b1..ef30635 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -34,8 +34,8 @@ importers:
         version: 5.2.0(pinia@4.0.2(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.6.0-rc.2(typescript@6.0.3)))(rolldown@1.2.1)(vite@8.2.0(@types/node@24.13.3)(jiti@2.7.0)(yaml@2.9.0))(vue@3.6.0-rc.2(typescript@6.0.3))
     devDependencies:
       '@playwright/test':
-        specifier: ^1.61.1
-        version: 1.62.1
+        specifier: 1.61.1
+        version: 1.61.1
       '@tsconfig/node24':
         specifier: ^24.0.4
         version: 24.0.4
@@ -688,9 +688,9 @@ packages:
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
     engines: {node: '>=14'}
 
-  '@playwright/test@1.62.1':
-    resolution: {integrity: sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==}
-    engines: {node: '>=20'}
+  '@playwright/test@1.61.1':
+    resolution: {integrity: sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==}
+    engines: {node: '>=18'}
     hasBin: true
 
   '@polka/url@1.0.0-next.29':
@@ -1856,14 +1856,14 @@ packages:
   pkg-types@2.3.1:
     resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==}
 
-  playwright-core@1.62.1:
-    resolution: {integrity: sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==}
-    engines: {node: '>=20'}
+  playwright-core@1.61.1:
+    resolution: {integrity: sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==}
+    engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.62.1:
-    resolution: {integrity: sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==}
-    engines: {node: '>=20'}
+  playwright@1.61.1:
+    resolution: {integrity: sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==}
+    engines: {node: '>=18'}
     hasBin: true
 
   postcss-selector-parser@7.1.4:
@@ -2847,9 +2847,9 @@ snapshots:
   '@pkgjs/parseargs@0.11.0':
     optional: true
 
-  '@playwright/test@1.62.1':
+  '@playwright/test@1.61.1':
     dependencies:
-      playwright: 1.62.1
+      playwright: 1.61.1
 
   '@polka/url@1.0.0-next.29': {}
 
@@ -3999,11 +3999,11 @@ snapshots:
       exsolve: 1.1.1
       pathe: 2.0.3
 
-  playwright-core@1.62.1: {}
+  playwright-core@1.61.1: {}
 
-  playwright@1.62.1:
+  playwright@1.61.1:
     dependencies:
-      playwright-core: 1.62.1
+      playwright-core: 1.61.1
     optionalDependencies:
       fsevents: 2.3.2