diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..62f7676
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,88 @@
+name: Auth CI/CD
+
+on:
+  pull_request:
+  push:
+    branches: [main, master, feature/spring-microservices, chore/registry-ci]
+
+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
+env:
+  IMAGE: ghcr.io/microsserv52/auth
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+      - run: ./mvnw --batch-mode validate
+
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          git diff --check
+          ! grep -R -n -E '^(<<<<<<<|=======|>>>>>>>)' --exclude-dir=.git .
+
+  test:
+    runs-on: ubuntu-latest
+    needs: [lint, format]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+      - run: ./mvnw --batch-mode --no-transfer-progress test
+
+  quality:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+      - run: ./mvnw --batch-mode --no-transfer-progress verify
+
+  security:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: java
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3
+
+  build:
+    runs-on: ubuntu-latest
+    needs: [quality, security]
+    if: github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:sha-${{ github.sha }}
+            ${{ env.IMAGE }}:latest
diff --git a/README.md b/README.md
index 128d2c0..ed2e4ed 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,20 @@ Set `ACCOUNT_URL` to the Account service URL. `JWT_SECRET` must be identical
 in Auth, Gateway, Account, and Order service. `INTERNAL_SERVICE_SECRET` must
 match Account.
 
+## Environment variables
+
+Set `ACCOUNT_URL`, `JWT_SECRET`, `INTERNAL_SERVICE_SECRET`, and
+`ACCESS_TOKEN_EXPIRATION_SECONDS` in the root platform `.env` locally. In
+GitHub Actions, use repository secrets; in Kubernetes, use ConfigMap values
+for URLs and `platform-secrets` for credentials.
+
+| Variable | Purpose |
+| --- | --- |
+| `ACCOUNT_URL` | Account service base URL |
+| `JWT_SECRET` | Shared JWT HMAC secret |
+| `INTERNAL_SERVICE_SECRET` | Account credential lookup secret |
+| `ACCESS_TOKEN_EXPIRATION_SECONDS` | Access-token lifetime |
+
 ## GitHub Actions secrets
 
 Add these under **Settings → Secrets and variables → Actions** in