diff --git a/.github/workflows/BUILD.bazel b/.github/workflows/BUILD.bazel
new file mode 100644
index 0000000..ad5a71a
--- /dev/null
+++ b/.github/workflows/BUILD.bazel
@@ -0,0 +1,3 @@
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["ci.yml"])
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..f75abd8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            phase8_target: linux-x64
+          - os: macos-14
+            phase8_target: darwin-arm64
+          - os: windows-latest
+            phase8_target: windows
+    runs-on: ${{ matrix.os }}
+    env:
+      USE_BAZEL_VERSION: 9.0.0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: bazel-contrib/setup-bazel@0.15.0
+      - name: Run tests (${{ matrix.phase8_target }})
+        run: bazel test //tests/...
diff --git a/README.md b/README.md
index f65b7fc..930c0d6 100644
--- a/README.md
+++ b/README.md
@@ -45,3 +45,9 @@ Phase 7 bootstrap is in place:
 
 - Bzlmod `bun_install` module extension (`/bun/extensions.bzl`) using Bazel 9-compatible extension/tag syntax
 - Focused module-extension shape test (`//tests/install_extension_test:all`)
+
+Phase 8 bootstrap is in place:
+
+- CI matrix workflow for linux-x64, darwin-arm64, and windows (`/.github/workflows/ci.yml`)
+- Bazel 9 pin in CI via `USE_BAZEL_VERSION=9.0.0`
+- Focused CI matrix shape test (`//tests/ci_test:all`)
diff --git a/tests/ci_test/BUILD.bazel b/tests/ci_test/BUILD.bazel
new file mode 100644
index 0000000..4f66e55
--- /dev/null
+++ b/tests/ci_test/BUILD.bazel
@@ -0,0 +1,8 @@
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
+
+sh_test(
+    name = "phase8_ci_matrix_shape_test",
+    srcs = ["phase8_ci_matrix_shape_test.sh"],
+    args = ["$(location //.github/workflows:ci.yml)"],
+    data = ["//.github/workflows:ci.yml"],
+)
diff --git a/tests/ci_test/phase8_ci_matrix_shape_test.sh b/tests/ci_test/phase8_ci_matrix_shape_test.sh
new file mode 100755
index 0000000..23930f0
--- /dev/null
+++ b/tests/ci_test/phase8_ci_matrix_shape_test.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workflow_file="$1"
+
+grep -Eq '^name:[[:space:]]+CI$' "${workflow_file}"
+grep -Eq 'USE_BAZEL_VERSION:[[:space:]]+9\.0\.0' "${workflow_file}"
+grep -Eq 'os:[[:space:]]+ubuntu-latest' "${workflow_file}"
+grep -Eq 'phase8_target:[[:space:]]+linux-x64' "${workflow_file}"
+grep -Eq 'os:[[:space:]]+macos-14' "${workflow_file}"
+grep -Eq 'phase8_target:[[:space:]]+darwin-arm64' "${workflow_file}"
+grep -Eq 'os:[[:space:]]+windows-latest' "${workflow_file}"
+grep -Eq 'phase8_target:[[:space:]]+windows' "${workflow_file}"