diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..5f79c51
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,142 @@
+# CI on the self-hosted GitLab, ported from the four workflows in
+# .github/workflows when the GitHub account was suspended on 2026-09-20. The
+# Actions files stay in the tree: they are the reference this was written from
+# and they work unchanged if the appeal succeeds.
+#
+# Images are pinned by digest, with the tag in the trailing comment. That is
+# the replacement for the SHA-pinned `uses:` in the workflows, since GitLab has
+# no action allowlist -- and it matters more here than elsewhere, because these
+# jobs exist to make a statement about what is in the tree.
+#
+# Two actions have no GitLab equivalent and are replaced by the tools they
+# wrap: EmbarkStudios/cargo-deny-action becomes cargo-deny installed in the
+# job, and the matrices become parallel:matrix. The command lines are the ones
+# the workflows were running, including the ignore and allow lists -- those are
+# licence policy, not configuration, and must not drift silently.
+
+stages: [licenses, security, checks]
+
+default:
+  interruptible: true
+
+.rules: &rules
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+
+.rust: &rust
+  image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
+  cache:
+    key: cargo-deny
+    paths: [.cargo/]
+  variables:
+    CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
+  before_script:
+    - cargo install cargo-deny --locked --quiet || cargo install cargo-deny --locked
+
+.go: &go
+  image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
+  cache:
+    key: go-tools
+    paths: [.gocache/]
+  variables:
+    GOPATH: "$CI_PROJECT_DIR/.gocache"
+  before_script:
+    - export PATH="$GOPATH/bin:$PATH"
+
+.node: &node
+  image: node:22-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9 # 22-bookworm-slim
+  variables:
+    NPM_CONFIG_CACHE: "$CI_PROJECT_DIR/.npm"
+  cache:
+    key:
+      files: [web/package-lock.json]
+    paths: [.npm/]
+
+# ------------------------------------------------------- licence compliance --
+rust-licenses:
+  <<: [*rust, *rules]
+  stage: licenses
+  parallel:
+    matrix:
+      - CRATE_DIR: [agent, search]
+  script:
+    - cargo deny --manifest-path "$CRATE_DIR/Cargo.toml" check licenses
+
+go-licenses:
+  <<: [*go, *rules]
+  stage: licenses
+  parallel:
+    matrix:
+      - MODULE_DIR: [api, ingest, alerting, enterprise, deploy/operator, terraform, proto, hack/benchmark-fixture, hack/windows-fixture]
+  script:
+    - go install github.com/google/go-licenses@latest
+    - cd "$MODULE_DIR"
+    - |
+      go-licenses check ./... \
+        --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0,0BSD,Unlicense \
+        --ignore github.com/cairnobs/cairnobs \
+        --ignore github.com/segmentio/asm
+
+npm-licenses:
+  <<: [*node, *rules]
+  stage: licenses
+  script:
+    - cd web
+    - npm ci
+    - |
+      npx --yes license-checker \
+        --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;MPL-2.0" \
+        --excludePackages "web@0.0.1"
+
+# ------------------------------------------------------------- security scan --
+rust-advisories:
+  <<: [*rust, *rules]
+  stage: security
+  parallel:
+    matrix:
+      - CRATE_DIR: [agent, search]
+  script:
+    - cargo deny --manifest-path "$CRATE_DIR/Cargo.toml" check advisories
+
+go-vulncheck:
+  <<: [*go, *rules]
+  stage: security
+  parallel:
+    matrix:
+      - MODULE_DIR: [api, ingest, alerting, enterprise, deploy/operator, terraform, proto, hack/benchmark-fixture, hack/windows-fixture]
+  script:
+    - go install golang.org/x/vuln/cmd/govulncheck@latest
+    - cd "$MODULE_DIR"
+    - govulncheck ./...
+
+npm-audit:
+  <<: [*node, *rules]
+  stage: security
+  script:
+    - cd web
+    - npm ci
+    - npm audit --omit=dev
+
+# -------------------------------------------------------------- other checks --
+# Both of these shell out to `go`, so they need the Go image rather than a
+# bare debian: on Actions the runner happened to have a toolchain on PATH and
+# the workflow never had to say so.
+tenant-boundary:
+  <<: [*go, *rules]
+  stage: checks
+  script:
+    - bash hack/check-tenant-boundary.sh
+
+web-routes:
+  <<: [*go, *rules]
+  stage: checks
+  script:
+    - bash hack/check-web-routes.sh
+
+conformance-corpus:
+  <<: *rules
+  stage: checks
+  image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
+  script:
+    - python3 processing/conformance/validate.py