diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df286ccc3b..d1798d6bb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,3 +46,41 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-workbench
       - run: bun run test
+
+  # Integration and browser suites under e2e/. CI=true turns DB- and
+  # Chrome-gated skips into hard failures.
+  e2e:
+    needs: setup
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: workbench
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      CI: "true"
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/workbench
+      # Throwaway keys for the ephemeral CI hub; same placeholders as .env.example.
+      CREDENTIAL_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
+      PRINCIPAL_KEY_ENCRYPTION_KEY: "1111111111111111111111111111111111111111111111111111111111111111"
+      SIDECAR_CREDENTIAL_ENCRYPTION_KEY: "2222222222222222222222222222222222222222222222222222222222222222"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-workbench
+      - id: chrome
+        uses: browser-actions/setup-chrome@v1
+      - run: echo "CHROME_PATH=${{ steps.chrome.outputs.chrome-path }}" >> "$GITHUB_ENV"
+      - run: |
+          mkdir -p "$RUNNER_TEMP/hub-data"
+          echo "HUB_DATA_DIR=$RUNNER_TEMP/hub-data" >> "$GITHUB_ENV"
+      - run: bun run test:e2e