diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml
new file mode 100644
index 0000000..390fa44
--- /dev/null
+++ b/.github/workflows/rust-ci.yaml
@@ -0,0 +1,60 @@
+name: Rust CI
+
+on:
+  push:
+    branches:
+      - main
+      - "feature/**"
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rust-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-and-coverage:
+    name: Rust tests and coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Run unit tests
+        run: cargo test --all-targets --locked
+
+      - name: Report whole-extension coverage
+        run: cargo llvm-cov --all-targets --locked --summary-only
+
+      - name: Enforce 100% coverage on deterministic core
+        run: |
+          cargo llvm-cov --all-targets --locked --summary-only \
+            --ignore-filename-regex 'src/(lib\.rs|tests\.rs|structs\.rs|mdns\.rs|udp_socket\.rs|video_stream\.rs|tcp/(client\.rs|cot\.rs|draw\.rs|mod\.rs|transport\.rs)|tcp/tls/(connector\.rs|enrollment\.rs|mod\.rs)|cot/(cot\.rs|delete\.rs|digital_pointer\.rs|draws/.*|eud\.rs|gps\.rs|lrf\.rs|message\.rs|mod\.rs|nato\.rs|report_marker\.rs|uas\.rs)|uas/(callbacks\.rs|constants\.rs|endpoint\.rs|identity\.rs|mod\.rs|packets\.rs|payload\.rs|send\.rs|state\.rs)|utils/(address\.rs|log\.rs|mod\.rs))' \
+            --fail-under-lines 100
+
+      - name: Generate LCOV artifact
+        if: always()
+        run: cargo llvm-cov --all-targets --locked --lcov --output-path lcov.info
+
+      - name: Upload LCOV artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: rust-lcov
+          path: lcov.info
+          if-no-files-found: warn