diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c1f2914..2154444 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -135,3 +135,18 @@ jobs:
           name: bench-results
           path: bench-results.txt
           retention-days: 30
+  memci:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v6
+
+    - uses: actions/setup-go@v6
+      with:
+        go-version: "1.26"
+
+    # Both binaries here are host tools. A TinyGo target would need
+    # acifani/setup-tinygo installed above and a build command naming it.
+    - uses: soypat/memci@main
+      with:
+        args: -kind package
+        targets: .github/memci.json
\ No newline at end of file
diff --git a/.github/workflows/memci-comment.yml b/.github/workflows/memci-comment.yml
new file mode 100644
index 0000000..e725a95
--- /dev/null
+++ b/.github/workflows/memci-comment.yml
@@ -0,0 +1,24 @@
+name: memci comment
+
+# Runs in the base repo's context with a write token, after the untrusted memci
+# workflow finishes. It never checks out or runs PR code; it only consumes the
+# report artifact as inert data.
+
+on:
+  workflow_run:
+    workflows: [memci]
+    types: [completed]
+
+permissions: read-all
+
+jobs:
+  comment:
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: soypat/memci/comment@main
+        with:
+          run-id: ${{ github.event.workflow_run.id }}