diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..8c53651
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,89 @@
+# SPDX-License-Identifier: CC0-1.0
+# SPDX-FileCopyrightText: NONE
+
+name: CI
+on:
+  push:
+    branches-ignore:
+    - 'wip/*'
+  pull_request:
+
+env:
+  XGCC_DIR: "/opt/xgcc"
+  XGCCPATH: "/opt/xgcc/bin"
+
+jobs:
+  toolchain:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    outputs:
+      models: ${{ steps.model-matrix.outputs.models }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        lfs: true
+        submodules: recursive
+        fetch-tags: true
+        fetch-depth: 0
+
+    - name: Get coreboot toolchain
+      id: get_coreboot_toolchain
+      uses: actions/cache@v4
+      with:
+        path: ${{ env.XGCC_DIR }}
+        key: coreboot-${{ hashFiles('coreboot/util/crossgcc/sum/*') }}
+
+    - name: Build coreboot toolchain
+      if: steps.get_coreboot_toolchain.outputs.cache-hit != 'true'
+      run: ./scripts/coreboot-sdk.sh DEST=$XGCC_DIR
+
+    - name: Generate model matrix
+      id: model-matrix
+      run: |
+        FIRMWARE_MODELS=$(find models/ -maxdepth 1 -mindepth 1 -type d -printf "%f\n" | jq -cRSs 'split("\n")[:-1]')
+        echo "models=$FIRMWARE_MODELS" >> $GITHUB_OUTPUT
+
+  build:
+    runs-on: ubuntu-24.04
+    needs: toolchain
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        model: ${{ fromJSON(needs.toolchain.outputs.models) }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        lfs: true
+        submodules: recursive
+        fetch-tags: true
+        fetch-depth: 0
+
+    - name: Fix coreboot submodules
+      working-directory: ./coreboot
+      run: git submodule update --init --checkout --recursive --force
+
+    - name: Get coreboot toolchain
+      id: get_coreboot_toolchain
+      uses: actions/cache@v4
+      with:
+        path: ${{ env.XGCC_DIR }}
+        key: coreboot-${{ hashFiles('coreboot/util/crossgcc/sum/*') }}
+        fail-on-cache-miss: true
+
+    - name: Install deps
+      run: |
+        ./scripts/install-deps.sh
+        ./scripts/install-rust.sh
+        pushd ec; ./scripts/deps.sh; popd
+
+    - name: Build firmware
+      run: ./scripts/build.sh "${{ matrix.model }}"
+
+    #- name: Upload artifacts
+    #  if: github.ref == 'refs/heads/master'
+    #  uses: actions/upload-artifact@v4
+    #  with:
+    #    name: ${{ matrix.model }}-${{ github.sha }}
+    #    path: build/
+    #    retention-days: 30
diff --git a/docs/building.md b/docs/building.md
index c860b0e..7121c94 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -1,9 +1,12 @@
 # Building
 
-Dependencies can be installed with the provided script.
+Dependencies can be installed with the provided scripts.
 
 ```
 ./scripts/install-deps.sh
+./scripts/install-rust.sh
+./scripts/coreboot-sdk.sh
+pushd ec; ./scripts/deps.sh; popd
 ```
 
 If rustup was installed for the first time, it will be required to source the
diff --git a/scripts/coreboot-sdk.sh b/scripts/coreboot-sdk.sh
index 4dbed5e..7cdce82 100755
--- a/scripts/coreboot-sdk.sh
+++ b/scripts/coreboot-sdk.sh
@@ -61,6 +61,8 @@ else
     exit 1
 fi
 
-make -C coreboot CPUS="$(nproc)" crossgcc-i386
-make -C coreboot CPUS="$(nproc)" crossgcc-x64
-make -C coreboot gitconfig
+make -C coreboot \
+    crossgcc-x64 \
+    crossgcc-i386 \
+    CPUS="$(nproc)" \
+    "${@}"
diff --git a/scripts/install-deps.sh b/scripts/install-deps.sh
index 436494d..107f8d6 100755
--- a/scripts/install-deps.sh
+++ b/scripts/install-deps.sh
@@ -5,99 +5,96 @@
 
 set -eE
 
-msg() {
-  echo -e "\x1B[1m$*\x1B[0m" >&2
-}
-
-trap 'msg "\x1B[31mFailed to install dependencies!"' ERR
-
 . /etc/os-release
-
-msg "Installing system build dependencies"
 if [[ "${ID}" =~ "debian" ]] || [[ "${ID_LIKE}" =~ "debian" ]]; then
-  sudo apt-get --quiet update
-  sudo apt-get --quiet install \
-    --no-install-recommends \
-    --assume-yes \
-    build-essential \
-    ccache \
-    cmake \
-    curl \
-    dosfstools \
-    flashrom \
-    git-lfs \
-    libncurses-dev \
-    libssl-dev \
-    libudev-dev \
-    mtools \
-    parted \
-    pkgconf \
-    python-is-python3 \
-    uuid-dev \
-    zlib1g-dev
+    sudo apt-get --quiet update
+    sudo apt-get --quiet install --no-install-recommends --assume-yes \
+        bison \
+        build-essential \
+        bzip2 \
+        ca-certificates \
+        ccache \
+        cmake \
+        curl \
+        dosfstools \
+        flashrom \
+        flex \
+        g++ \
+        gcc \
+        git-lfs \
+        gnat \
+        libncurses-dev \
+        libnss3-dev \
+        libssl-dev \
+        libudev-dev \
+        make \
+        mtools \
+        parted \
+        patch \
+        pkgconf \
+        python-is-python3 \
+        tar \
+        uuid-dev \
+        xz-utils \
+        zlib1g-dev
 elif [[ "${ID}" =~ "fedora" ]] || [[ "${ID_LIKE}" =~ "fedora" ]]; then
-  sudo dnf group install c-development
-  sudo dnf install \
-    --assumeyes \
-    ccache \
-    cmake \
-    curl \
-    dosfstools \
-    flashrom \
-    git-lfs \
-    libuuid-devel \
-    mtools \
-    ncurses-devel \
-    openssl-devel \
-    parted \
-    patch \
-    python-unversioned-command \
-    python3 \
-    systemd-devel \
-    zlib-devel
+    sudo dnf group install c-development
+    sudo dnf install --assumeyes \
+        bison \
+        bzip2 \
+        ca-certificates \
+        ccache \
+        cmake \
+        curl \
+        dosfstools \
+        flashrom \
+        flex \
+        gcc \
+        gcc-c++ \
+        gcc-gnat \
+        git-lfs \
+        libuuid-devel \
+        make \
+        mtools \
+        ncurses-devel \
+        nss-devel \
+        openssl-devel \
+        parted \
+        patch \
+        python-unversioned-command \
+        python3 \
+        rustup \
+        systemd-devel \
+        tar \
+        xz \
+        zlib-devel
 elif [[ "${ID}" =~ "arch" ]] || [[ "${ID_LIKE}" =~ "arch" ]]; then
-  sudo pacman -S \
-    --noconfirm \
-    ccache \
-    cmake \
-    curl \
-    dosfstools \
-    flashrom \
-    git-lfs \
-    mtools \
-    ncurses \
-    parted \
-    patch \
-    python \
-    systemd-libs
+    sudo pacman -S --noconfirm \
+        bison \
+        bzip2 \
+        ca-certificates \
+        ccache \
+        cmake \
+        curl \
+        dosfstools \
+        flashrom \
+        flex \
+        gcc \
+        gcc-ada \
+        git-lfs \
+        make \
+        mtools \
+        ncurses \
+        nss \
+        parted \
+        patch \
+        python \
+        rustup \
+        systemd-libs \
+        tar \
+        xz \
+        zlib
 else
-  msg "Unknown system ID: ${ID}"
-  msg "Please add support for your distribution to: $0"
-  exit 1
+    echo "unsupported host: ${ID}"
+    exit 1
 fi
-
-# Don't run on Jenkins
-if [ -z "${CI}" ]; then
-    msg "Installing GIT LFS hooks"
-    git lfs install
-
-    msg "Downloading GIT LFS artifacts"
-    git lfs pull
-fi
-
-msg "Initializing submodules"
-git submodule update --init --recursive --checkout --progress
-
-msg "Building coreboot toolchains"
-./scripts/coreboot-sdk.sh
-
-msg "Installing Rust toolchain and components"
-./scripts/install-rust.sh
-
-msg "Installing EC dependencies"
-pushd ec
-./scripts/deps.sh
-popd
-
-msg "\x1B[32mSuccessfully installed dependencies"
-echo "Ready to run ./scripts/build.sh [model]" >&2
diff --git a/scripts/install-rust.sh b/scripts/install-rust.sh
index 0ebf9a7..263e293 100755
--- a/scripts/install-rust.sh
+++ b/scripts/install-rust.sh
@@ -8,20 +8,18 @@
 
 set -Ee
 
-RUSTUP_NEW_INSTALL=0
-
-# NOTE: rustup is used to allow multiple toolchain installations.
 if ! command -v rustup >/dev/null 2>&1; then
-    RUSTUP_NEW_INSTALL=1
-    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-        | sh -s -- -y --default-toolchain stable
+    if command -v rustup-init >/dev/null 2>&1; then
+        rustup-init -y \
+            --default-toolchain stable \
+            --profile minimal \
+            --no-update-default-toolchain
+    else
+        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --default-toolchain stable
+    fi
 
     . "${HOME}/.cargo/env"
 fi
 
 rustup show active-toolchain || rustup toolchain install
-
-if [ "$RUSTUP_NEW_INSTALL" = "1" ]; then
-    printf "\e[33m>> rustup was just installed. Ensure cargo is on the PATH with:\e[0m\n"
-    printf "    source ~/.cargo/env\n\n"
-fi