diff --git a/.github/scripts/cargo-audit.sh b/.github/scripts/cargo-audit.sh
new file mode 100755
index 0000000..3659e62
--- /dev/null
+++ b/.github/scripts/cargo-audit.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -e
+
+repo_root=$(git rev-parse --show-toplevel)
+
+# shellcheck disable=SC1091
+source "$repo_root/.github/scripts/rust-version.sh" stable >/dev/null
+
+cargo +"$rust_stable" audit
diff --git a/.github/scripts/cargo-clippy.sh b/.github/scripts/cargo-clippy.sh
new file mode 100755
index 0000000..ccbfddd
--- /dev/null
+++ b/.github/scripts/cargo-clippy.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -e
+
+repo_root=$(git rev-parse --show-toplevel)
+
+# shellcheck disable=SC1091
+source "$repo_root/.github/scripts/rust-version.sh" nightly >/dev/null
+
+rustup component add clippy --toolchain="$rust_nightly"
+cargo +"$rust_nightly" clippy
diff --git a/.github/scripts/cargo-fmt.sh b/.github/scripts/cargo-fmt.sh
new file mode 100755
index 0000000..525b326
--- /dev/null
+++ b/.github/scripts/cargo-fmt.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -e
+
+repo_root=$(git rev-parse --show-toplevel)
+
+# shellcheck disable=SC1091
+source "$repo_root/.github/scripts/rust-version.sh" nightly >/dev/null
+
+rustup component add rustfmt --toolchain="$rust_nightly"
+cargo +"$rust_nightly" fmt --all
diff --git a/.github/scripts/cargo-test.sh b/.github/scripts/cargo-test.sh
new file mode 100755
index 0000000..a652367
--- /dev/null
+++ b/.github/scripts/cargo-test.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -e
+
+repo_root=$(git rev-parse --show-toplevel)
+
+# shellcheck disable=SC1091
+source "$repo_root/.github/scripts/rust-version.sh" stable >/dev/null
+
+cargo +"$rust_stable" test
diff --git a/scripts/read-cargo-variable.sh b/.github/scripts/read-cargo-variable.sh
similarity index 93%
rename from scripts/read-cargo-variable.sh
rename to .github/scripts/read-cargo-variable.sh
index 7f6c951..190ac3e 100755
--- a/scripts/read-cargo-variable.sh
+++ b/.github/scripts/read-cargo-variable.sh
@@ -1,4 +1,4 @@
-# source this file
+#!/usr/bin/env bash
 
 readCargoVariable() {
   declare variable="$1"
diff --git a/.github/scripts/rust-version.sh b/.github/scripts/rust-version.sh
new file mode 100755
index 0000000..a1cea02
--- /dev/null
+++ b/.github/scripts/rust-version.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# This file maintains the rust versions for use by CI.
+#
+# Obtain the environment variables without any automatic toolchain updating:
+#   $ source <path>/rust-version.sh
+#
+# Obtain the environment variables updating both stable and nightly, only stable, or
+# only nightly:
+#   $ source <path>/rust-version.sh all
+#   $ source <path>/rust-version.sh stable
+#   $ source <path>/rust-version.sh nightly
+
+# Then to build with either stable or nightly:
+#   $ cargo +"$rust_stable" build
+#   $ cargo +"$rust_nightly" build
+
+repo_root=$(git rev-parse --show-toplevel)
+
+# stable version
+if [[ -n $RUST_STABLE_VERSION ]]; then
+  stable_version="$RUST_STABLE_VERSION"
+else
+  # shellcheck disable=SC1090,SC1091
+  source "$repo_root/.github/scripts/read-cargo-variable.sh"
+  stable_version=$(readCargoVariable channel "$repo_root/rust-toolchain.toml")
+fi
+
+# nightly version
+if [[ -n $RUST_NIGHTLY_VERSION ]]; then
+  nightly_version="$RUST_NIGHTLY_VERSION"
+else
+  nightly_version=2024-01-05
+fi
+
+export rust_stable="$stable_version"
+export rust_nightly=nightly-"$nightly_version"
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 [all|stable|nightly]"
+  exit 1
+fi
+
+case $1 in
+all)
+  toolchains=("$rust_stable" "$rust_nightly")
+  ;;
+stable)
+  toolchains=("$rust_stable")
+  ;;
+nightly)
+  toolchains=("$rust_nightly")
+  ;;
+*)
+  echo "Usage: $0 [all|stable|nightly]"
+  exit 1
+  ;;
+esac
+
+for toolchain in "${toolchains[@]}"; do
+  if ! cargo +"$toolchain" -V >/dev/null; then
+    echo "$0: installing $toolchain"
+    rustup install "$toolchain"
+    cargo +"$toolchain" -V
+  else
+    echo "$0: $toolchain has already installed."
+  fi
+done
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 0000000..7e0f066
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,26 @@
+name: Audit
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/**
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+  schedule:
+    - cron: "0 4 * * *"
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+
+      - name: "Audit"
+        run: |
+          .github/scripts/cargo-audit.sh
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
new file mode 100644
index 0000000..75124f1
--- /dev/null
+++ b/.github/workflows/rust.yml
@@ -0,0 +1,27 @@
+name: Rust
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+
+      - name: "Fmt"
+        run: |
+          .github/scripts/cargo-fmt.sh
+
+      - name: "Clippy"
+        run: |
+          .github/scripts/cargo-clippy.sh
+
+      - name: "Test"
+        run: |
+          .github/scripts/cargo-test.sh
diff --git a/Cargo.lock b/Cargo.lock
index d345c2c..9d1f7c0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -545,9 +545,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51ee2dd2e4f378392eeff5d51618cd9a63166a2513846bbc55f21cfacd9199d4"
+checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
 dependencies = [
  "bytes",
  "fnv",
diff --git a/ci/rust-version.sh b/ci/rust-version.sh
deleted file mode 100755
index 97ebb1c..0000000
--- a/ci/rust-version.sh
+++ /dev/null
@@ -1,70 +0,0 @@
-#
-# This file maintains the rust versions for use by CI.
-#
-# Obtain the environment variables without any automatic toolchain updating:
-#   $ source ci/rust-version.sh
-#
-# Obtain the environment variables updating both stable and nightly, only stable, or
-# only nightly:
-#   $ source ci/rust-version.sh all
-#   $ source ci/rust-version.sh stable
-#   $ source ci/rust-version.sh nightly
-
-# Then to build with either stable or nightly:
-#   $ cargo +"$rust_stable" build
-#   $ cargo +"$rust_nightly" build
-#
-
-if [[ -n $RUST_STABLE_VERSION ]]; then
-  stable_version="$RUST_STABLE_VERSION"
-else
-  # read rust version from rust-toolchain.toml file
-  base="$(dirname "${BASH_SOURCE[0]}")"
-  # pacify shellcheck: cannot follow dynamic path
-  # shellcheck disable=SC1090,SC1091
-  source "$base/../scripts/read-cargo-variable.sh"
-  stable_version=$(readCargoVariable channel "$base/../rust-toolchain.toml")
-fi
-
-if [[ -n $RUST_NIGHTLY_VERSION ]]; then
-  nightly_version="$RUST_NIGHTLY_VERSION"
-else
-  nightly_version=2024-01-05
-fi
-
-
-export rust_stable="$stable_version"
-
-export rust_nightly=nightly-"$nightly_version"
-
-export ci_docker_image="anzaxyz/ci:rust_${rust_stable}_${rust_nightly}"
-
-[[ -z $1 ]] || (
-
-  rustup_install() {
-    declare toolchain=$1
-    if ! cargo +"$toolchain" -V > /dev/null; then
-      echo "$0: Missing toolchain? Installing...: $toolchain" >&2
-      rustup install "$toolchain"
-      cargo +"$toolchain" -V
-    fi
-  }
-
-  set -e
-  cd "$(dirname "${BASH_SOURCE[0]}")"
-  case $1 in
-  stable)
-     rustup_install "$rust_stable"
-     ;;
-  nightly)
-     rustup_install "$rust_nightly"
-    ;;
-  all)
-     rustup_install "$rust_stable"
-     rustup_install "$rust_nightly"
-    ;;
-  *)
-    echo "$0: Note: ignoring unknown argument: $1" >&2
-    ;;
-  esac
-)
diff --git a/scripts/cargo-fmt.sh b/scripts/cargo-fmt.sh
deleted file mode 100755
index 25cab23..0000000
--- a/scripts/cargo-fmt.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-here="$(dirname "$0")"
-cargo="$(readlink -f "${here}/../cargo")"
-
-if [[ -z $cargo ]]; then
-  >&2 echo "Failed to find cargo. Mac readlink doesn't support -f. Consider switching
-  to gnu readlink with 'brew install coreutils' and then symlink greadlink as
-  /usr/local/bin/readlink."
-  exit 1
-fi
-
-fmt_dirs=(
-  .
-)
-
-for fmt_dir in "${fmt_dirs[@]}"; do
-  (
-    manifest_path="$(readlink -f "$here"/../"$fmt_dir"/Cargo.toml)"
-    set -ex
-    "$cargo" nightly fmt --all --manifest-path "$manifest_path"
-  )
-done