diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 0000000..0a81c90
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,62 @@
+name: CHERIoT RTOS Tests
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      devcontainer:
+        description: 'Set to override default build container'
+        type: string
+        required: false
+
+jobs:
+  build-demos:
+    strategy:
+      matrix:
+        build-type: [ debug, release ]
+        demo: [compartmentalisation, configuration_broker_ibex, configuration_broker_sonata, HughV1, HughV2]
+        include:
+          - xmake-run: false
+          - build-type: debug
+            build-flags: --debug-loader=y --debug-scheduler=y --debug-allocator=information --allocator-rendering=y -m debug
+          - build-type: release
+            build-flags: --debug-loader=n --debug-scheduler=n --debug-allocator=none -m release --stack-usage-check-allocator=y --stack-usage-check-scheduler=y
+          - demo: compartmentalisation
+            build-dir: compartmentalisation
+          - demo: HughV1
+            build-dir: HughTheLightbulb/Device
+            extra-config: --IPv6=n --network-inject-faults=y --scheduler-accounting=y
+          - demo: HughV2
+            build-dir: HughTheLightbulbV2/Device
+            extra-config: --IPv6=n --network-inject-faults=y --scheduler-accounting=y
+          - demo: configuration_broker_sonata
+            build-dir: configuration_broker/sonata
+            extra-config: --IPv6=n
+          - demo: configuration_broker_ibex
+            build-dir: configuration_broker/ibex-safe-simulator
+            xmake-run: true
+      fail-fast: false
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ inputs.devcontainer || 'ghcr.io/cheriot-platform/devcontainer:latest' }}
+      options: --user 1001
+    steps:
+    - name: Checkout repository and submodules
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    - name: Build Demo
+      run: |
+        echo ${{ matrix.build-dir }} ${{ matrix.extra-config }} ${{ matrix.build-flags }}
+        cd ${{ matrix.build-dir }}
+        xmake f --sdk=/cheriot-tools/ ${{ matrix.extra-config }} ${{ matrix.build-flags }}
+        xmake
+    - name: Run Demo
+      if: ${{ matrix.xmake-run }}
+      run: |
+        cd ${{ matrix.build-dir }}
+        xmake run
diff --git a/cheriot-rtos b/cheriot-rtos
index ca9845a..71fa772 160000
--- a/cheriot-rtos
+++ b/cheriot-rtos
@@ -1 +1 @@
-Subproject commit ca9845a80efba06649e1bfb971e443e0da028686
+Subproject commit 71fa772669d0c50f512a48485ad7df6c286451fc
diff --git a/configuration_broker/README.md b/configuration_broker/README.md
index 70ae162..89bc962 100644
--- a/configuration_broker/README.md
+++ b/configuration_broker/README.md
@@ -631,5 +631,5 @@ sonata-config/Config/MySonata-0/rbg_LED
 ```
 
 
-[^init] Yet. See https://github.com/CHERIoT-Platform/cheriot-rtos/issues/275
+[^init]: Yet. See https://github.com/CHERIoT-Platform/cheriot-rtos/issues/275