diff --git a/.github/workflows/baseline.yml b/.github/workflows/baseline.yml
new file mode 100644
index 0000000..081d5c7
--- /dev/null
+++ b/.github/workflows/baseline.yml
@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: The devcontainer.java Authors
+# SPDX-License-Identifier: 0BSD
+
+name: Baseline
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    uses: metio/ci/.github/workflows/baseline.yml@d4a165ac035d1fa1a7aee5b27192d0aed9c7a0b0 # 2026.11.1111906
+  baseline:
+    name: Baseline
+    needs: [checks]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - env:
+          RESULT: ${{ needs.checks.result }}
+        run: '[ "$RESULT" = success ] || { echo "::error::the baseline checks ended in $RESULT"; exit 1; }'