diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
new file mode 100644
index 0000000..d98229d
--- /dev/null
+++ b/.gitea/workflows/docker.yml
@@ -0,0 +1,33 @@
+name: Docker image (Gitea)
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test and build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Run tests
+        run: ./scripts/test.sh
+
+      - name: Build and run container smoke test
+        run: ./tests/container-smoke.sh
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 6c45b70..6c6855e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,4 +1,4 @@
-name: Docker image
+name: Docker image (GitHub)
 
 on:
   push:
diff --git a/tests/workflow-contract.sh b/tests/workflow-contract.sh
index 9d7df2f..d0dd315 100755
--- a/tests/workflow-contract.sh
+++ b/tests/workflow-contract.sh
@@ -1,32 +1,51 @@
 #!/bin/sh
 set -eu
 
-workflow=.github/workflows/docker.yml
-test -f "$workflow" || {
-	echo "missing GHCR workflow: $workflow" >&2
+github_workflow=.github/workflows/docker.yml
+gitea_workflow=.gitea/workflows/docker.yml
+
+test -f "$github_workflow" || {
+	echo "missing GHCR workflow: $github_workflow" >&2
+	exit 1
+}
+test -f "$gitea_workflow" || {
+	echo "missing Gitea workflow: $gitea_workflow" >&2
 	exit 1
 }
 
-grep -F 'packages: write' "$workflow" >/dev/null
-# Match the GitHub expression literally.
-# shellcheck disable=SC2016
-grep -F 'ghcr.io/${{ github.repository }}' "$workflow" >/dev/null
-grep -F 'platforms: linux/amd64' "$workflow" >/dev/null
-grep -F 'needs: test' "$workflow" >/dev/null
-grep -F 'run: ./tests/container-smoke.sh' "$workflow" >/dev/null
-grep -F 'cache-to: type=gha,mode=max,ignore-error=true' "$workflow" >/dev/null
-# Match the GitHub expression literally.
-# shellcheck disable=SC2016
-grep -F 'push: ${{ github.event_name != '\''pull_request'\'' }}' "$workflow" >/dev/null
+for workflow in "$github_workflow" "$gitea_workflow"; do
+	grep -F '  push:' "$workflow" >/dev/null
+	grep -F '  pull_request:' "$workflow" >/dev/null
+	grep -F '  workflow_dispatch:' "$workflow" >/dev/null
+done
 
-if grep -Ei 'arm64|setup-qemu' "$workflow" >/dev/null; then
+grep -F 'packages: write' "$github_workflow" >/dev/null
+# Match the GitHub expression literally.
+# shellcheck disable=SC2016
+grep -F 'ghcr.io/${{ github.repository }}' "$github_workflow" >/dev/null
+grep -F 'platforms: linux/amd64' "$github_workflow" >/dev/null
+grep -F 'needs: test' "$github_workflow" >/dev/null
+grep -F 'run: ./tests/container-smoke.sh' "$github_workflow" >/dev/null
+grep -F 'cache-to: type=gha,mode=max,ignore-error=true' "$github_workflow" >/dev/null
+# Match the GitHub expression literally.
+# shellcheck disable=SC2016
+grep -F 'push: ${{ github.event_name != '\''pull_request'\'' }}' "$github_workflow" >/dev/null
+
+grep -F 'run: ./scripts/test.sh' "$gitea_workflow" >/dev/null
+grep -F 'run: ./tests/container-smoke.sh' "$gitea_workflow" >/dev/null
+if grep -Ei 'ghcr\.io|github\.|GITHUB_TOKEN|packages: write|docker/(login|build-push)-action' "$gitea_workflow" >/dev/null; then
+	echo "Gitea workflow must not depend on GitHub publishing" >&2
+	exit 1
+fi
+
+if grep -Ei 'arm64|setup-qemu' "$github_workflow" >/dev/null; then
 	echo "workflow must build linux/amd64 only and must not configure QEMU" >&2
 	exit 1
 fi
 
-uses_count=$(grep -Ec '^[[:space:]]+uses:' "$workflow")
-pinned_count=$(grep -Ec '^[[:space:]]+uses: [^ ]+@[0-9a-f]{40}([[:space:]]|$)' "$workflow")
+uses_count=$(grep -Ehc '^[[:space:]]+uses:' "$github_workflow" "$gitea_workflow" | awk '{ total += $1 } END { print total }')
+pinned_count=$(grep -Ehc '^[[:space:]]+uses: [^ ]+@[0-9a-f]{40}([[:space:]]|$)' "$github_workflow" "$gitea_workflow" | awk '{ total += $1 } END { print total }')
 if [ "$uses_count" -eq 0 ] || [ "$uses_count" -ne "$pinned_count" ]; then
-	echo "every GitHub Action must be pinned to a full commit SHA" >&2
+	echo "every action must be pinned to a full commit SHA" >&2
 	exit 1
 fi