diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 819853d..13427b0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,5 @@
 # Builds Windows, macOS and Linux on GitHub's runners when a v* tag is pushed, then publishes a
-# GitHub release with the files. Gitea reads .github/workflows too, so every job is gated on the
+# GitHub release with the files once the full test suite (test.yml) passes. Gitea reads .github/workflows too, so every job is gated on the
 # server URL: this pipeline only ever runs on github.com.
 name: release
 
@@ -20,6 +20,10 @@ env:
   TAG: ${{ inputs.tag || github.ref_name }}
 
 jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+    with: { ref: "${{ inputs.tag || github.ref }}" }
+
   windows:
     if: github.server_url == 'https://github.com'
     runs-on: windows-latest
@@ -78,7 +82,7 @@ jobs:
 
   publish:
     if: github.server_url == 'https://github.com'
-    needs: [windows, macos, linux]
+    needs: [test, windows, macos, linux]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/download-artifact@v4
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..f8a20c2
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,34 @@
+# The full test suite. Local runs cover only the targets a change touches (RULES.md, "The machine
+# you build on"); this is where everything runs, before a release can publish. Run it alone with
+# `gh workflow run test.yml -f ref=<branch or tag>`. Gitea reads .github/workflows too, so the job
+# is gated on the server URL.
+name: test
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: false
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Branch or tag to test (default the one you run from)
+        required: false
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    if: github.server_url == 'https://github.com'
+    # Windows: the platform the app is developed on, and its runners render with a software GPU.
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { ref: "${{ inputs.ref || github.ref }}" }
+      - uses: dtolnay/rust-toolchain@stable
+        with: { targets: wasm32-unknown-unknown }
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --locked --no-fail-fast
+      - run: cargo check --locked --lib --target wasm32-unknown-unknown