diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 0000000..5d25b5a
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,67 @@
+# Renders the chart the Argo CD apps in argo/ read from this branch and checks the manifests.
+# Read only: no secrets, nothing is applied.
+# Tool images are pinned by digest; bump the digest and the comment together.
+name: validate
+
+on:
+  pull_request:
+  push:
+    branches: [prod-v3]
+
+permissions:
+  contents: read
+
+jobs:
+  charts:
+    name: charts (${{ matrix.release }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { release: dembrane-web-prod, chart: helm/dembrane-web, values: "values-prod.yaml" }
+          - { release: dembrane-web-eu-prod, chart: helm/dembrane-web, values: "values-eu-prod.yaml" }
+          - { release: dembrane-web-dummy, chart: helm/dembrane-web, values: "values-prod.yaml values-echo-next.yaml" }
+    timeout-minutes: 15
+    env:
+      # alpine/helm 3.x
+      HELM: alpine/helm@sha256:e3f8d5c462d75470fbb1fce79ad5c20063657096d1f98c0fcea869e2600e2e5e
+      # kubeconform 0.8.0
+      KUBECONFORM: ghcr.io/yannh/kubeconform@sha256:faffaf43f95aa6425306e1ab8d6fcad72acb9049158f38e574c085ea1ec0f64e
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Lint and render ${{ matrix.release }}, check manifests
+        env:
+          RELEASE: ${{ matrix.release }}
+          CHART: ${{ matrix.chart }}
+          VALUES: ${{ matrix.values }}
+        run: |
+          set -euo pipefail
+          # Same value files as the Argo CD app of that name in argo/.
+          args=()
+          for f in $VALUES; do args+=(-f "$CHART/$f"); done
+          helm() { docker run --rm -v "$PWD:/w:ro" -w /w "$HELM" "$@"; }
+          helm lint "$CHART" "${args[@]}"
+          helm template "$RELEASE" "$CHART" "${args[@]}" |
+            docker run --rm -i "$KUBECONFORM" -strict -ignore-missing-schemas -summary -
+
+  manifests:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      # kubeconform 0.8.0
+      KUBECONFORM: ghcr.io/yannh/kubeconform@sha256:faffaf43f95aa6425306e1ab8d6fcad72acb9049158f38e574c085ea1ec0f64e
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Check Applications and backup Jobs
+        run: |
+          set -euo pipefail
+          # Applied by hand; Argo CD resource kinds have no schema here and are skipped.
+          docker run --rm -v "$PWD:/w:ro" -w /w "$KUBECONFORM" \
+            -strict -ignore-missing-schemas -summary argo/dembrane-web-*.yaml backup/*.yaml