diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..b5abebd
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,38 @@
+name: ci
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '17 3 * * 1'  # weekly: track upstream blob updates
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fetch MediaTek WiFi blobs (linux-firmware HEAD)
+        run: tools/fetch_blobs.sh firmware/mediatek
+      - name: Tests (golden manifests, ELF emitter)
+        run: make test
+        env:
+          MTK_FW_DIR: ${{ github.workspace }}/firmware/mediatek
+
+  track:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Clone linux-firmware history
+        run: |
+          git clone --no-checkout https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git lf
+      - name: Walk blob history
+        run: python3 tools/fw_history.py lf -o /tmp/history.jsonl
+      - name: Report new revisions since last committed dataset
+        run: |
+          diff <(cat dataset/history.jsonl) /tmp/history.jsonl > /tmp/history.diff || true
+          wc -l /tmp/history.diff
+          head -100 /tmp/history.diff || true
+      - uses: actions/upload-artifact@v4
+        with:
+          name: upstream-history-${{ github.run_id }}
+          path: /tmp/history.jsonl
diff --git a/Makefile b/Makefile
index 5c2e0b1..b3c6e6e 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ BLOBS ?= $(wildcard /lib/firmware/mediatek/mt79*_wm.bin) \
         $(wildcard /lib/firmware/mediatek/mt79*_wa.bin) \
         $(wildcard /lib/firmware/mediatek/mt79*_rom_patch.bin)
 
-.PHONY: help extract test elf
+.PHONY: help extract test elf fetch-fw
 
 help:
 	@echo "make extract  - carve all MediaTek Connac2 blobs found on this host"
@@ -16,3 +16,6 @@ test:
 
 elf:
 	python3 tools/mtk_fw_elf.py $(BLOBS) -o extracted
+
+fetch-fw:
+	tools/fetch_blobs.sh firmware/mediatek
diff --git a/tests/test_extract.py b/tests/test_extract.py
index 8302ec4..b51774d 100644
--- a/tests/test_extract.py
+++ b/tests/test_extract.py
@@ -15,11 +15,15 @@ REPO = Path(__file__).resolve().parent.parent
 FW = Path(os.environ.get('MTK_FW_DIR', '/lib/firmware/mediatek'))
 
 # filename -> (chip_id, eco, n_region, hidden_trailer_string_or_None)
+# Golden values observed from linux-firmware HEAD (2026-06-19 tree:
+# mt7981/mt7986 = 20260515 builds; mt7915/mt7916 = 2022/2024 builds,
+# unchanged since). When a value here fails against a newer snapshot, the
+# blob changed — update the golden *and* record the diff (docs/reports/).
 GOLDEN_WM = {
     'mt7981_wm.bin': (0x14, 0, 11,
-                      't-neptune-main-mt7915-1953-MT7981_MP2111_IMP-20240823161204'),
+                      't-neptune-main-mt7915-1953-MT7981_MP2111_IMP-20260515121129'),
     'mt7986_wm.bin': (0x0f, 0, 11,
-                      't-neptune-main-mt7915-1953-MT7986_MP2111_IMP-20240823160608'),
+                      't-neptune-main-mt7915-1953-MT7986_MP2111_IMP-20260515120228'),
     'mt7916_wm.bin': (0x13, 0, 9,
                       't-neptune-main-mt7915-1953-MT7916_MP2111_IMP-20240823170147'),
     'mt7915_wm.bin': (0x0b, 1, 7,
diff --git a/tools/fetch_blobs.sh b/tools/fetch_blobs.sh
new file mode 100755
index 0000000..63b24cb
--- /dev/null
+++ b/tools/fetch_blobs.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Fetch MediaTek Connac2 WiFi blobs from linux-firmware (cgit plain URLs).
+# No clone, ~8 MB total. Usage: tools/fetch_blobs.sh [destdir]
+set -e
+DEST=${1:-firmware/mediatek}
+BASE=https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain
+mkdir -p "$DEST"
+for f in \
+    mt7915_wm.bin mt7915_wa.bin mt7915_rom_patch.bin \
+    mt7916_wm.bin mt7916_wa.bin mt7916_rom_patch.bin \
+    mt7981_wm.bin mt7981_wa.bin mt7981_rom_patch.bin mt7981_wo.bin \
+    mt7986_wm.bin mt7986_wa.bin mt7986_rom_patch.bin mt7986_wo_0.bin mt7986_wo_1.bin
+do
+    if [ -s "$DEST/$f" ]; then
+        echo "have $f"
+        continue
+    fi
+    echo "fetch $f"
+    curl -fsSL "$BASE/mediatek/$f" -o "$DEST/$f"
+done
+ls -l "$DEST"