diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..18a3a97
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,34 @@
+name: tests
+
+on:
+  pull_request:
+  push:
+    branches: [version-4.5.x]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Python 2.7 is the reason this branch exists. setup-python no longer
+          # ships 2.7, so the suite runs in the official image.
+          - python: "2.7"
+            pins: "pytest==4.6.11 mock==3.0.5 pyasn1==0.4.8"
+          - python: "3.8"
+            pins: "pytest mock pyasn1"
+    container: python:${{ matrix.python }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install
+        run: |
+          python -m pip install --disable-pip-version-check ${{ matrix.pins }}
+          python -m pip install --disable-pip-version-check --no-deps -e .
+      # tox.ini's [pytest] addopts asks for pytest-cov; CI only needs the result.
+      - name: Test
+        run: python -m pytest -o addopts= -v tests