diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
deleted file mode 100644
index adb983d..0000000
--- a/.gitea/workflows/ci.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: CI
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.26'
-
-      - name: gofmt
-        run: test -z "$(gofmt -l .)"
-
-      - run: go build ./...
-
-      - run: go vet ./...
-
-      - run: go test ./...
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: '12'
-
-      - name: web check
-        working-directory: web
-        run: pnpm install --frozen-lockfile && pnpm check
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 74e90a7..d1de73f 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@ BINARY  := vellum
 VERSION ?= 0.4.0-dev
 LDFLAGS := -s -w -X main.version=$(VERSION)
 
-.PHONY: build web build-go dev run test fmt vet tidy check docker clean
+.PHONY: build web build-go dev run test fmt vet tidy check gate docker clean
 
 # Backend + Vite dev server together, with hot reload. Ctrl-C stops both.
 dev:
@@ -39,9 +39,22 @@ vet:
 tidy:
 	go mod tidy
 
-# What CI should run.
+# Fix formatting, then vet and test. Rewrites files, so it is a fixer, not a
+# gate — use `gate` before pushing.
 check: fmt vet test
 
+# The same checks as check, but verify-only: gate never rewrites a file.
+gate:
+	gofmt_out=$$(gofmt -l .); if [ -n "$$gofmt_out" ]; then echo "gofmt: not formatted:"; echo "$$gofmt_out"; exit 1; fi
+	echo "go build"
+	go build ./...
+	echo "go vet"
+	go vet ./...
+	echo "go test"
+	go test ./...
+	echo "web check"
+	cd web && pnpm install --frozen-lockfile && pnpm check
+
 docker:
 	podman build --build-arg VERSION=$(VERSION) -t localhost/vellum:$(VERSION) .