diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e962e8..2f39772 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,6 +108,48 @@ jobs:
       - run: make proto-fmt
       - run: make check-protos check-api-descriptors
 
+  #
+  # Unit tests
+  #
+  tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+        with:
+          go-version-file: '.github/.tool-versions'
+      - name: Run unit tests
+        run: go test -race -count=1 $(go list ./... | grep -v /integration)
+
+  #
+  # Fuzz tests
+  #
+  fuzz:
+    name: Fuzz Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+        with:
+          go-version-file: '.github/.tool-versions'
+      - name: Run all fuzz tests
+        run: |
+          # Find all packages containing fuzz tests and run each target.
+          # go test -fuzz only accepts one package at a time and one
+          # matching fuzz target, so we discover and iterate.
+          grep -r --include='*_test.go' -l '^func Fuzz' . | while read -r file; do
+            pkg=$(dirname "$file")
+            grep -o '^func Fuzz[A-Za-z0-9_]*' "$file" | sed 's/^func //' | while read -r target; do
+              echo "=== Fuzzing ${target} in ${pkg} ==="
+              go test "${pkg}" -fuzz="^${target}$" -fuzztime=60s
+            done
+          done
+
   #
   # Build kernels on cache miss
   #