diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..4b1c697
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @riptideslabs/devs
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..dc80d63
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,12 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: raven-actions/actionlint@v2
diff --git a/README.md b/README.md
index cfdb1d0..cb8e307 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,14 @@
 
 GitHub Action to install the [Riptides](https://riptides.io) daemon and join a control plane from a GitHub Actions runner. Authentication uses GitHub Actions OIDC, no join tokens or long-lived credentials required.
 
+## What is Riptides?
+
+Riptides is a zero-trust networking layer that runs as a kernel module on your hosts. For CI pipelines it solves two problems:
+
+**Secure secret injection** — instead of storing cloud credentials, API keys, or service tokens in GitHub secrets, Riptides gives the runner a verified SPIFFE workload identity and enforces your policy at the network layer. Your CI job calls AWS, S3, internal APIs, or any other service exactly as it would in production — credentials are injected transparently based on the runner's identity, without ever touching a secret.
+
+**Connection visibility** — every outbound and inbound TCP connection made during a CI job is tracked with full workload identity context: which workflow, which repository, which actor made the call, and whether it was allowed or denied by policy. This gives you the same traffic observability and access control in CI that you have across the rest of your fleet.
+
 ## Prerequisites
 
 1. A Riptides control plane with a `GitHubActionsVerifier` configured for your repository owner:
diff --git a/action.yml b/action.yml
index acd6a5c..d5321da 100644
--- a/action.yml
+++ b/action.yml
@@ -27,5 +27,6 @@ runs:
         DAEMON_VERSION: ${{ inputs.version }}
       run: |
         curl -fsSL https://docs.riptides.io/install.sh | sudo -E bash -s -- \
-          --control-plane "${{ inputs.controlplane-url }}" \
-          --github-actions "${{ inputs.audience }}"
+          --controlplane-url "${{ inputs.controlplane-url }}" \
+          --plugin GitHubActions \
+          --github-actions-audience "${{ inputs.audience }}"