diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
new file mode 100644
index 0000000..323d881
--- /dev/null
+++ b/.github/actions/setup-node/action.yml
@@ -0,0 +1,19 @@
+name: Setup Node
+description: Setup Node with yarn and install dependencies
+
+runs:
+  using: composite
+  steps:
+    - name: Enable corepack
+      shell: bash
+      run: corepack enable
+
+    - name: Setup Node.js
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+      with:
+        node-version-file: '.nvmrc'
+        cache: 'yarn'
+
+    - name: Install dependencies
+      shell: bash
+      run: yarn install --immutable
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..6643890
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup node
+        uses: ./.github/actions/setup-node
+
+      - name: Run format
+        run: yarn format --check
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup node
+        uses: ./.github/actions/setup-node
+
+      - name: Run lint
+        run: yarn lint
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup node
+        uses: ./.github/actions/setup-node
+
+      - name: Run build
+        run: yarn build
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index ca0ff26..8abb507 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -12,7 +12,7 @@ jobs:
       # A Docker image with Semgrep installed. Do not change this.
       image: returntocorp/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: semgrep ci
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN_PUBLIC }}
diff --git a/.nvmrc b/.nvmrc
index 016e34b..a3b7a31 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v20.17.0
+v24.14.1
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 7fbc6ee..2bd70fd 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -1,3 +1,6 @@
 {
-  "plugins": ["eslint", "import", "oxc", "react", "typescript"]
+  "plugins": ["eslint", "import", "oxc", "react", "typescript"],
+  "categories": {
+    "correctness": "error"
+  }
 }
diff --git a/yarn.lock b/yarn.lock
index 266b08d..d10cff2 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1115,6 +1115,11 @@ __metadata:
   peerDependencies:
     react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
     react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+  peerDependenciesMeta:
+    react:
+      optional: true
+    react-dom:
+      optional: true
   languageName: unknown
   linkType: soft