diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..a794d60
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,66 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Cancel superseded runs on the same ref (e.g. rapid pushes to a PR) so CI
+# minutes aren't spent on commits that are already outdated.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pytest:
+    runs-on: ubuntu-latest
+    strategy:
+      # Don't let one version's failure cancel the others; we want the full
+      # picture across the supported range on every run.
+      fail-fast: false
+      matrix:
+        # Covers the project's declared `requires-python = ">=3.10"` range.
+        # 3.8/3.9 are excluded because the `mcp` dependency requires >=3.10.
+        python-version: ["3.10", "3.11"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          # Key the pip cache on the file that actually drives the install
+          # (`pip install -e ".[dev]"` reads pyproject.toml), not the default
+          # requirements.txt glob, so the cache busts when deps change.
+          cache-dependency-path: pyproject.toml
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Install package
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Fetch TLC tools
+        # tla2tools.jar, pinned to the same version as scripts/setup_tools.py,
+        # so the TLC-gated behavioral tests run in CI instead of skipping.
+        run: |
+          mkdir -p lib
+          curl -fL --retry 3 -o lib/tla2tools.jar \
+            https://github.com/tlaplus/tlaplus/releases/download/v1.8.0/tla2tools.jar
+
+      - name: Run tests
+        # Scope note: tests/test_languages is deterministic and exercises real
+        # TLC. tests/test_models is excluded for now -- test_model_connection.py
+        # makes live provider API calls that need secrets, and
+        # test_litellm_adapter.py has pre-existing failures tracked separately.
+        run: pytest tests/test_languages
diff --git a/pyproject.toml b/pyproject.toml
index e2b8678..8311036 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,13 +17,11 @@ classifiers = [
     "Intended Audience :: Science/Research",
     "License :: OSI Approved :: Apache Software License",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.8",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Topic :: Scientific/Engineering :: Artificial Intelligence",
 ]
-requires-python = ">=3.8"
+requires-python = ">=3.10"
 dependencies = [
     "litellm>=1.0.0",
     "pyyaml>=6.0.0",
@@ -60,10 +58,10 @@ include = ["tla_eval*"]
 
 [tool.black]
 line-length = 88
-target-version = ['py38']
+target-version = ['py310']
 
 [tool.mypy]
-python_version = "3.8"
+python_version = "3.10"
 warn_return_any = true
 warn_unused_configs = true
 disallow_untyped_defs = true