diff --git a/.forgejo/workflows/checks.yml b/.forgejo/workflows/checks.yml
new file mode 100644
index 0000000..4177921
--- /dev/null
+++ b/.forgejo/workflows/checks.yml
@@ -0,0 +1,22 @@
+# Shared checks from capyadmin/ci-workflows: secret scanning, SAST,
+# dependency vulnerabilities and lint. See that repo's README for inputs and
+# how to accept a finding.
+name: checks
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  secrets:
+    runs-on: ubuntu-latest
+    uses: capyadmin/ci-workflows/.forgejo/workflows/secrets.yml@main
+  sast:
+    runs-on: ubuntu-latest
+    uses: capyadmin/ci-workflows/.forgejo/workflows/sast.yml@main
+  deps:
+    runs-on: ubuntu-latest
+    uses: capyadmin/ci-workflows/.forgejo/workflows/deps.yml@main
+  lint:
+    runs-on: ubuntu-latest
+    uses: capyadmin/ci-workflows/.forgejo/workflows/lint.yml@main