diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 00000000..0d40c3c3
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,150 @@
+stages:
+  - lint
+  - security
+  - test
+  - build
+  - release
+
+variables:
+  CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
+  CARGO_INCREMENTAL: "0"
+  CARGO_TERM_COLOR: "always"
+  RUST_BACKTRACE: "short"
+  RUSTFLAGS: "-D warnings"
+  SCCACHE_DIR: "$CI_PROJECT_DIR/.sccache"
+
+default:
+  image: rust:slim
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq --no-install-recommends
+        pkg-config libssl-dev clang cmake protobuf-compiler git curl ca-certificates
+    - rustup show  # installs channel from rust-toolchain.toml (1.88.0)
+    - rustup target add wasm32-unknown-unknown
+    - cargo --version && rustc --version
+  cache:
+    key:
+      files:
+        - Cargo.lock
+        - rust-toolchain.toml
+    paths:
+      - .cargo/registry/
+      - .cargo/git/
+      - target/
+    policy: pull-push
+  interruptible: true
+  timeout: 3h
+
+# ─── LINT ────────────────────────────────────────────────────────────────────
+
+fmt:
+  stage: lint
+  script:
+    - cargo fmt --all -- --check
+  allow_failure: false
+
+check:
+  stage: lint
+  script:
+    - cargo check --workspace --locked
+  allow_failure: false
+
+clippy:
+  stage: lint
+  script:
+    - cargo clippy --workspace --locked -- -D warnings
+  allow_failure: false
+
+# ─── SECURITY ────────────────────────────────────────────────────────────────
+
+cargo-audit:
+  stage: security
+  script:
+    - cargo install cargo-audit --quiet
+    - cargo audit
+  allow_failure: true  # advisory-only; does not block merge
+
+cargo-deny:
+  stage: security
+  script:
+    - cargo install cargo-deny --quiet
+    - cargo deny check --config deny.toml
+  allow_failure: false
+
+license-check:
+  stage: security
+  script:
+    - |
+      echo "Checking Apache-2.0 license headers..."
+      if [ ! -f LICENSE-APACHE ]; then
+        echo "ERROR: LICENSE-APACHE missing" && exit 1
+      fi
+      if [ ! -f NOTICE ]; then
+        echo "ERROR: NOTICE file missing" && exit 1
+      fi
+      echo "✅ License files present"
+  allow_failure: false
+
+# ─── TEST ────────────────────────────────────────────────────────────────────
+
+unit-tests:
+  stage: test
+  script:
+    - cargo test --workspace --lib --locked 2>&1 | tee test-results.txt
+  artifacts:
+    when: always
+    paths:
+      - test-results.txt
+    expire_in: 7 days
+  allow_failure: false
+
+wasm-check:
+  stage: test
+  script:
+    - cargo check -p pezkuwichain-runtime --locked --target wasm32-unknown-unknown
+  allow_failure: false
+
+# ─── BUILD ───────────────────────────────────────────────────────────────────
+
+build:
+  stage: build
+  script:
+    - cargo build --release -p pezkuwi --locked 2>&1 | tee build.log
+    - ls -lh target/release/pezkuwi target/release/pezkuwi-execute-worker target/release/pezkuwi-prepare-worker
+  artifacts:
+    paths:
+      - target/release/pezkuwi
+      - target/release/pezkuwi-execute-worker
+      - target/release/pezkuwi-prepare-worker
+    expire_in: 1 day
+    when: on_success
+  only:
+    - main
+    - tags
+
+# ─── RELEASE ─────────────────────────────────────────────────────────────────
+
+release:
+  stage: release
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  before_script: []  # override default before_script — no Rust needed
+  needs:
+    - build
+  script:
+    - echo "Creating release $CI_COMMIT_TAG"
+  release:
+    tag_name: "$CI_COMMIT_TAG"
+    name: "Pezkuwi SDK $CI_COMMIT_TAG"
+    description: |
+      ## Pezkuwi SDK $CI_COMMIT_TAG
+
+      Binary artifacts built from this release are attached.
+
+      **Install:**
+      ```bash
+      curl -LO https://gitlab.com/pezkuwichain/pezkuwi-sdk/-/releases/$CI_COMMIT_TAG/downloads/pezkuwi
+      chmod +x pezkuwi
+      ```
+  only:
+    - /^v\d+\.\d+\.\d+$/
+  except:
+    - branches