diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
new file mode 100644
index 0000000..89156e7
--- /dev/null
+++ b/.tangled/workflows/ci.yml
@@ -0,0 +1,30 @@
+when:
+  - event: ["push", "pull_request"]
+    branch: main
+  - event: ["manual"]
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - curl
+    - gnutar
+    - xz
+
+steps:
+  - name: install zig 0.16
+    command: |
+      curl -sSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar -xJ -C /tangled/workspace
+      mv /tangled/workspace/zig-x86_64-linux-0.16.0 /tangled/workspace/.zig
+
+  - name: check formatting
+    command: |
+      /tangled/workspace/.zig/zig fmt --check .
+
+  - name: unit tests (debug)
+    command: |
+      /tangled/workspace/.zig/zig build test --summary all
+
+  - name: unit tests (releasesafe)
+    command: |
+      /tangled/workspace/.zig/zig build test -Doptimize=ReleaseSafe --summary all
diff --git a/.tangled/workflows/publish-image.yml b/.tangled/workflows/publish-image.yml
new file mode 100644
index 0000000..5d04515
--- /dev/null
+++ b/.tangled/workflows/publish-image.yml
@@ -0,0 +1,44 @@
+# Build the linux/amd64 image on a native x86 runner and push it to atcr.io,
+# tagged by commit sha only — tags never move, and `scripts/admit verify`
+# continues to gate deployment on the receipt-pinned digest.
+#
+# Requires the ATCR_APP_PASSWORD pipeline secret (repo settings): the
+# registry app password for the zat.dev account on atcr.io.
+
+when:
+  - event: ["push"]
+    branch: ["main"]
+  - event: ["manual"]
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - kaniko
+    - coreutils
+
+environment:
+  DOCKER_CONFIG: "/kaniko/.docker"
+
+steps:
+  - name: configure kaniko
+    command: |
+      mkdir -p /kaniko/.docker/
+      auth=$(printf 'zat.dev:%s' "$ATCR_APP_PASSWORD" | base64 -w0)
+      echo "{
+        \"auths\": {
+          \"https://atcr.io/v1\":{
+            \"auth\": \"$auth\"
+          }
+        }
+      }" > /kaniko/.docker/config.json
+
+  - name: build and push image
+    command: |
+      executor \
+        --context=$(pwd) \
+        --ignore-path=$(pwd) \
+        --dockerfile=$(pwd)/Dockerfile \
+        --destination="atcr.io/zat.dev/stream:$TANGLED_COMMIT_SHA" \
+        --push-retry=3 \
+        --skip-push-permission-check