diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 898bdfa..923e678 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,54 @@
 name: CI
+
 on:
   push:
     branches: ["main"]
   pull_request:
     branches: ["main"]
+
+permissions:
+  contents: read
+
 jobs:
-  hello:
+  compile:
+    # Byte-compile every first-party .py to catch syntax errors. No deps.
     runs-on: ubuntu-latest
     steps:
-      - run: echo "hello"
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: py_compile first-party sources
+        run: |
+          git ls-files '*.py' | grep -vE '^(yt_dlp|spotify_dl)/' | xargs python -m py_compile
+          echo "All first-party sources compile."
+
+  unit:
+    # Pure-logic tests; tested modules guard heavy deps, so only pytest needed.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install test deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install pytest
+      - name: Run unit tests
+        run: pytest tests/unit -v
+
+  integration:
+    # Boot the Flask services and assert the X-Conjurer-Api-Key auth contract.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install service deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install pytest flask waitress requests
+      - name: Run integration tests
+        run: pytest tests/integration -v