diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..e680f0c
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,41 @@
+---
+name: check
+
+"on":
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: write
+
+# this allows a subsequently queued workflow run to interrupt previous runs in pull requests only
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install mise
+        uses: taiki-e/install-action@v2
+        with:
+          tool: mise
+
+      - name: Install mise tools
+        run: |
+          mise settings add idiomatic_version_file_enable_tools "[]"
+          mise install
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Run checkers
+        run: |
+          mise run check
diff --git a/.mise.toml b/.mise.toml
index bb64685..1441162 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -1,4 +1,5 @@
 [tools]
+action-validator = "latest"
 "cargo:taplo-cli" = "latest"
 "cargo:wasm-pack" = "latest"
 "chromedriver" = "146"
@@ -11,7 +12,7 @@ osv-scanner = "latest"
 pipx = "latest"
 "pipx:cmake" = "latest"
 protoc = "latest"
-rust = "latest"
+rust = { version = "latest", components = "clippy" }
 typos = "latest"
 
 [tasks]
@@ -23,6 +24,9 @@ editorconfig-check = "ec"
 depends = ["cargo-fmt", "dprint-fmt", "taplo-fmt"]
 description = "Run repository formatters"
 
+[tasks.install-nightly]
+run = "rustup toolchain install nightly --component rustfmt"
+
 [tasks.check]
 depends = [
   "cargo-check",
@@ -40,9 +44,11 @@ description = "Run repository checks"
 run = "cargo check --workspace"
 
 [tasks.cargo-fmt]
+depends = ["install-nightly"]
 run = "cargo +nightly fmt"
 
 [tasks.cargo-fmt-check]
+depends = ["install-nightly"]
 run = "cargo +nightly fmt -- --check"
 
 [tasks.cargo-clippy]
@@ -58,6 +64,7 @@ run = "taplo lint"
 run = "typos"
 
 [tasks.osv-scanner]
+depends = ["cargo-check"]
 run = "osv-scanner --lockfile Cargo.lock"
 
 [tasks.ws-server]