diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
new file mode 100644
index 0000000..c33adf2
--- /dev/null
+++ b/.github/workflows/test-build.yml
@@ -0,0 +1,40 @@
+name: test-build
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+  schedule:
+    - cron: '30 3 * * 2'
+
+concurrency:
+  group: "${{ github.ref }}"
+  cancel-in-progress: true
+jobs:
+  build-debian:
+    strategy:
+      # Keep other matrix jobs running, even if one fails.
+      fail-fast: false
+      matrix:
+        host_release:
+        - unstable
+        - trixie
+        - bookworm
+
+    # We want a working shell, qemu, python and docker. Specific version should not matter (much).
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - run: ./test/gha-build-deb.sh
+      name: "Build .deb for ${{matrix.host_release}}"
+      env:
+        HOST_RELEASE: ${{matrix.host_release}}
+
+    - name: Archive built .deb
+      uses: actions/upload-artifact@v4
+      with:
+        name: deb-${{matrix.host_release}}
+        if-no-files-found: error
+        path: |
+          *.deb
diff --git a/test/docker-build-deb.sh b/test/docker-build-deb.sh
new file mode 100755
index 0000000..55d9ed8
--- /dev/null
+++ b/test/docker-build-deb.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Build a grml2usb.deb.
+# To be run inside docker, as this script assumes it can modify the running OS.
+
+set -eu -o pipefail
+set -x
+
+if [ "${1:-}" != "--autobuild" ]; then
+  echo "$0: Only intended for CI scenarios, will destroy source files and modify running OS." >&2
+  exit 1
+fi
+BUILD_NUMBER="${2:-}"
+if [ -z "$BUILD_NUMBER" ]; then
+  echo "$0: missing build number in arguments" >&2
+  exit 1
+fi
+
+apt-get update
+apt-get install -qq -y --no-install-recommends build-essential devscripts equivs
+
+SOURCEDIR=$PWD
+
+cd /tmp
+mk-build-deps -ir -t 'apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y' "$SOURCEDIR"/debian/control
+
+dpkg-source -b "$SOURCEDIR"
+dpkg-source -x ./*.dsc builddir
+cd builddir
+
+OLD_VERSION=$(dpkg-parsechangelog -SVersion)
+
+cat > debian/changelog <<EOT
+grml2usb (${OLD_VERSION}+autobuild${BUILD_NUMBER}) UNRELEASED; urgency=medium
+
+  * Automated Build
+
+ -- Automated Build <builder@localhost>  $(date -R)
+EOT
+
+dpkg-buildpackage -b --no-sign
+
+mv ../*deb "$SOURCEDIR"/
diff --git a/test/gha-build-deb.sh b/test/gha-build-deb.sh
new file mode 100755
index 0000000..d70ad69
--- /dev/null
+++ b/test/gha-build-deb.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Entrypoint for GitHub Actions to build a grml2usb.deb.
+
+set -eu -o pipefail
+set -x
+
+if [ -z "${CI:-}" ] || [ -z "${GITHUB_RUN_NUMBER:-}" ]; then
+  echo "Running outside of CI pipeline." >&2
+  exit 1
+fi
+
+docker run --privileged -v "$(pwd)":/code --rm -i debian:"$HOST_RELEASE" \
+    bash -c 'TERM='"$TERM"' cd /code && ./test/docker-build-deb.sh --autobuild '"$GITHUB_RUN_NUMBER"