diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 72d4cab..5101a48 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -7,22 +7,47 @@ on:
 
 jobs:
   check:
-    runs-on: docker
-    container: docker.io/library/rust:1-bookworm
+    runs-on: rust-ci
     steps:
       - uses: actions/checkout@v4
 
-      - name: Cache cargo registry and target dir
+      - name: Cache cargo registry and build artifacts
         uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
+            ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Cache sccache compilation objects
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/sccache
+          # Not keyed to Cargo.lock: sccache caches individual compiler
+          # invocations by content hash, so it should accumulate across
+          # dependency bumps rather than reset like the target/ cache above.
+          key: sccache-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            sccache-${{ runner.os }}-
 
       - name: Add wasm target
         run: rustup target add wasm32-unknown-unknown
 
+      - name: Format check
+        run: cargo fmt --check
+
+      - name: Clippy (native crates)
+        run: cargo clippy --workspace --exclude feedsignal-web --all-targets -- -D warnings
+
+      - name: Clippy (web crate, server)
+        run: cargo clippy -p feedsignal-web --no-default-features --features server --all-targets -- -D warnings
+
+      - name: Clippy (web crate, wasm client)
+        run: cargo clippy -p feedsignal-web --no-default-features --features web --target wasm32-unknown-unknown -- -D warnings
+
       - name: Check native crates
         run: cargo check --workspace --exclude feedsignal-web
 
@@ -32,5 +57,39 @@ jobs:
       - name: Check web crate (wasm client)
         run: cargo check -p feedsignal-web --no-default-features --features web --target wasm32-unknown-unknown
 
+  test:
+    needs: check
+    runs-on: rust-ci
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Cache sccache compilation objects
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/sccache
+          key: sccache-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            sccache-${{ runner.os }}-
+
       - name: Test
         run: cargo test --workspace --exclude feedsignal-web
+
+  audit:
+    needs: test
+    runs-on: rust-ci
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: cargo audit
+        run: cargo audit