diff --git a/.tangled/workflows/build.yml b/.tangled/workflows/build.yml
new file mode 100644
index 0000000..4d5acce
--- /dev/null
+++ b/.tangled/workflows/build.yml
@@ -0,0 +1,36 @@
+when:
+  - event: [push, manual, pull_request]
+    branch: [main, ci]
+
+engine: microvm
+image: almalinux10-x86_64
+
+steps:
+  - name: Build and push
+    command: |
+      set -exuo pipefail
+
+      df -h
+
+      sudo dnf copr enable -y ligenix/enterprise-qemu-spice
+      sudo dnf update -y
+      sudo dnf install -y bsdtar podman qemu-kvm
+
+      curl -sSfL https://raw.githubusercontent.com/aquaproj/aqua-installer/main/aqua-installer | bash
+      export PATH=$HOME/.local/share/aquaproj-aqua/bin:$PATH
+      aqua i
+
+      # TODO: put this under aqua
+      helm plugin install --verify=false https://github.com/databus23/helm-diff
+
+      bazel build //:load //:clippy //tests:generated
+      bazel run //tests:venv
+      source .venv/bin/activate
+      # XXX: for some reason this isn't in the venv
+      $(bazel cquery '@uv_deps//:ruff' --output=files)/bin/ruff check
+      basedpyright tests/
+
+      just vm-create
+      just test
+
+      bazel-bin/load.sh