diff --git a/.ci/all_commits.sh b/.ci/all_commits.sh
new file mode 100755
index 00000000..b44f48c5
--- /dev/null
+++ b/.ci/all_commits.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Test all commits on this branch but the last one.
+#
+# Used in the all_commits ci job to ensure all commits build
+# and tests pass at least for the sequoia-openpgp crate.
+
+# Use dummy identity to make git rebase happy.
+git config user.name "C.I. McTestface"
+git config user.email "ci.mctestface@example.com"
+
+# If the previous commit already is on main we're done.
+git merge-base --is-ancestor HEAD~ origin/main &&
+  echo "All commits tested already" &&
+  exit 0
+
+# Leave out the last commit - it has already been checked.
+git checkout HEAD~
+git rebase origin/main \
+           --exec 'echo ===; echo ===; echo ===; git log -n 1;' \
+           --exec 'cargo test -p sequoia-openpgp' &&
+  echo "All commits passed tests" &&
+  exit 0
+
+# The rebase failed - probably because a test failed.
+git rebase --abort; exit 1
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 00000000..f955b1b7
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,195 @@
+stages:
+  - pre-check
+  - build
+  - test
+
+# These stanzas do some common management tasks before and after the
+# job-specific before_script and after_script stanzas are run.
+# before_script_start configures any default global state.  The
+# job-specific before_script can override this state, if required.
+# before_script_end prints out information about the environment to
+# improve debugging; it does not modify the environment.
+# after_script_end does some common management tasks after the
+# job-specific after_script is run.  It prints information about the
+# environment, and does some clean up.
+#
+# Add this to your stanza as follows:
+#
+#   before_script:
+#     - *before_script_start
+#     - *** YOUR CODE HERE ***
+#     - *before_script_end
+#   after_script:
+#     - *** YOUR CODE HERE ***
+#     - *after_script_end
+
+.before_script_start: &before_script_start
+  - 'if test "x${RUSTFLAGS+SET}" = xSET; then echo "\$RUSTFLAGS is set ($RUSTFLAGS)"; exit 1; fi'
+
+.before_script_end: &before_script_end
+  - 'if test "x${RUSTFLAGS+SET}" = xSET; then echo "WARNING: before_script set \$RUSTFLAGS ($RUSTFLAGS)"; fi'
+  - rustc --version --verbose
+  - cargo --version
+  - clang -v
+  - if [ -d $CARGO_TARGET_DIR ]; then find $CARGO_TARGET_DIR | wc --lines; du -sh $CARGO_TARGET_DIR; fi
+  - if [ -d $CARGO_HOME ]; then find $CARGO_HOME | wc --lines; du -sh $CARGO_HOME; fi
+
+.after_script_end: &after_script_end
+  - if [ -d $CARGO_TARGET_DIR ]; then find $CARGO_TARGET_DIR -type f -atime +7 -delete; fi
+  - if [ -d $CARGO_TARGET_DIR ]; then du -sh $CARGO_TARGET_DIR; fi
+  - if [ -d $CARGO_HOME ]; then du -sh $CARGO_HOME; fi
+
+before_script:
+  - *before_script_start
+  - *before_script_end
+
+after_script:
+  - *after_script_end
+
+bookworm:
+  tags:
+    - linux
+  stage: build
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/bookworm:latest
+  script:
+    - cargo test
+    - if ! git diff --quiet Cargo.lock ; then echo "Cargo.lock changed.  Please add the change to the corresponding commit." ; git diff ; false ; fi
+    - if ! git diff --quiet ; then echo "The build changed the source.  Please investigate." ; git diff ; fi
+  variables:
+    CARGO_TARGET_DIR: /target
+    CARGO_HOME: /cargo
+
+sq-features:
+  tags:
+    - linux
+  stage: build
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/bookworm:latest
+  only:
+    refs:
+      - tags
+      - web
+      - schedules
+  parallel:
+    matrix:
+      - FEATURES:
+        - ""
+        - "autocrypt"
+        - "autocrypt,compression-bzip2"
+        - "compression-bzip2"
+  script:
+    - cargo test --no-default-features --features crypto-nettle --features $FEATURES
+  variables:
+    CARGO_TARGET_DIR: /target
+    CARGO_HOME: /cargo
+
+bookworm-crypto-openssl:
+  tags:
+    - linux
+  stage: build
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/bookworm:latest
+  dependencies:
+    - codespell
+  script:
+    - cargo test --no-default-features --features crypto-openssl,compression-bzip2
+  variables:
+    CARGO_TARGET_DIR: /target
+    CARGO_HOME: /cargo
+
+all_commits:
+  # Test each commit up to main, to facilitate bisecting.
+  stage: test
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/rust-stable:latest
+  needs: ["rust-stable"]
+  script:
+    - .ci/all_commits.sh
+  variables:
+    CARGO_TARGET_DIR: /target
+    CARGO_HOME: /cargo
+    GIT_STRATEGY: clone
+
+codespell:
+  tags:
+    - linux
+  stage: pre-check
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/bookworm:latest
+
+  before_script:
+    - *before_script_start
+    - codespell --version
+    - *before_script_end
+  script:
+    - codespell --summary -L "crate,ede,iff,mut,nd,te,uint,KeyServer,keyserver,Keyserver,keyservers,Keyservers,keypair,keypairs,KeyPair,fpr,dedup,deriver" -S "*.bin,*.gpg,*.pgp,./.git,*/target"
+
+rust-stable:
+  tags:
+    - linux
+  stage: build
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/rust-stable:latest
+  before_script:
+    - *before_script_start
+    - rustup override set stable
+    - *before_script_end
+  script:
+    - cargo test
+  variables:
+    CARGO_TARGET_DIR: /target
+    CARGO_HOME: /cargo
+
+clippy:
+  tags:
+    - linux
+  stage: build
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/rust-stable:latest
+  before_script:
+    - *before_script_start
+    - apt-get -y install libssl-dev capnproto libsqlite3-dev
+    - rustup default 1.60.0
+    - rustup component add clippy
+    - cargo clippy --version
+    - *before_script_end
+  script:
+    - cargo clippy
+  variables:
+    CARGO_TARGET_DIR: /target
+    CARGO_HOME: /cargo
+
+windows-msvc-cng:
+  tags:
+    - win
+    - win2019
+  stage: build
+  interruptible: true
+  image: 192.168.122.1:5000/sequoia-pgp/build-docker-image/windows-msvc
+  only:
+    variables:
+      # Forks of this project most likely use gitlab's shared windows runners, which
+      # do not use the docker executor, so disable the windows jobs for forks.
+      - $CI_PROJECT_NAMESPACE == "sequoia-pgp"
+  before_script:
+    # We don't call *before_script_start or *before_script_end as we
+    # don't have bash, clang, etc.
+    - rustup default "1.60.0"
+    - rustc --version --verbose
+    - cargo --version
+  script:
+    - Remove-Item tests\sq-subplot.rs # until https://gitlab.com/subplot/subplot/-/issues/232 is fixed
+    - cargo test --no-default-features --features crypto-cng,compression-bzip2
+  after_script: [] # scriptlet doesn't work on Powershell
+  variables:
+    CFLAGS: "" # Silence some C warnings when compiling with MSVC
+
+variables:
+  DEBIAN_FRONTEND: noninteractive
+  CARGO_HOME: $CI_PROJECT_DIR/../cargo
+  CARGO_FLAGS: --color always
+  CARGO_INCREMENTAL: 0
+  RUST_BACKTRACE: full
+  CFLAGS: -Werror
+  QUICKCHECK_GENERATOR_SIZE: 500 # https://github.com/BurntSushi/quickcheck/pull/240