diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..9bb449e
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,92 @@
+# Borrowed from https://github.com/jonhoo/rust-ci-conf/blob/6332a3af21a58f811a681a98cd44d0f5da8a1891/.github/workflows/check.yml
+# See the [screencast] by Jon Gjengset.
+#
+# [screencast]: https://www.youtube.com/watch?v=xUH-4y92jPg
+
+name: check
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  fmt:
+    name: stable / fmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - name: cargo fmt --check --all
+        run: cargo fmt --check --all
+        working-directory: rust/
+
+  clippy:
+    name: ${{ matrix.toolchain }} / clippy
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: [stable, beta]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install ${{ matrix.toolchain }}
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+          components: clippy
+      - name: cargo clippy
+        uses: actions-rs/clippy-check@v1
+        with:
+          # Github Actions don't support `working-dir` in the `uses` context.
+          # Specify `--manifest-path` as a workaround.
+          #
+          # See https://github.com/actions-rs/clippy-check/issues/28
+          args: --all-features --workspace --manifest-path rust/Cargo.toml
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  doc:
+    name: nightly / doc
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install nightly
+        uses: dtolnay/rust-toolchain@nightly
+      - name: cargo doc
+        run: cargo doc --no-deps --all-features --document-private-items --workspace
+        working-directory: rust/
+
+  hack:
+    name: ubuntu / stable / features
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install stable
+        uses: dtolnay/rust-toolchain@stable
+      - name: cargo install cargo-hack
+        uses: taiki-e/install-action@cargo-hack
+      # Intentionally no target specifier; see https://github.com/jonhoo/rust-ci-conf/pull/4
+      - name: cargo hack
+        run: cargo hack --feature-powerset --workspace check
+        working-directory: rust/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..78004bc
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,82 @@
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to build release binaries for'
+        required: true
+        type: string
+  push:
+    tags:
+      - v[0-9]+.*
+  release:
+    types: [created]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  RUSTFLAGS: --deny warnings -Cdebuginfo=0
+  RUSTDOCFLAGS: --deny warnings
+
+jobs:
+  create-release:
+    name: Create GitHub release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: taiki-e/create-gh-release-action@v1
+        with:
+          changelog: rust/CHANGELOG.md
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  build-and-upload:
+    name: ${{ matrix.job.target }}
+    runs-on: ${{ matrix.job.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          # NOTE: Use compute resources sparingly. Don't use GitHub-hosted macOS runners
+          # in a non-public repository -- they consume CI/CD minutes like crazy; see
+          # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#minute-multipliers
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc }
+          #- { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          #- { os: ubuntu-latest, target: aarch64-unknown-linux-gnu }
+          #- { os: ubuntu-latest, target: aarch64-unknown-linux-musl }
+          #- { os: macos-latest, target: x86_64-apple-darwin }
+          #- { os: macos-latest, target: aarch64-apple-darwin }
+          #- { os: macos-latest, target: universal-apple-darwin }
+
+    steps:
+    - name: Check for release
+      id: is-release
+      shell: bash
+      run: |
+        is_release=false
+        if [[ $GITHUB_REF =~ ^refs/tags/v[0-9].* ]]; then
+            is_release=true
+        fi
+        echo "is_release=$is_release" >> $GITHUB_OUTPUT
+
+    - uses: actions/checkout@v4
+      if: steps.is-release.outputs.is_release
+      with:
+        submodules: true
+    - uses: actions/checkout@v4
+      if: ${{ !steps.is-release.outputs.is_release }}
+      with:
+        ref: ${{ inputs.tag }}
+        submodules: true
+
+    - uses: taiki-e/upload-rust-binary-action@v1
+      with:
+        bin: ja4,ja4x
+        archive: ja4-$tag-$target
+        target: ${{ matrix.job.target }}
+        include: rust/ja4/README.md
+        token: ${{ secrets.GITHUB_TOKEN }}
+        manifest_path: rust/Cargo.toml
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..d7ed5e8
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,85 @@
+# Borrowed from https://github.com/jonhoo/rust-ci-conf/blob/6332a3af21a58f811a681a98cd44d0f5da8a1891/.github/workflows/test.yml
+# See the [screencast] by Jon Gjengset.
+#
+# [screencast]: https://www.youtube.com/watch?v=xUH-4y92jPg
+
+name: test
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: ubuntu / ${{ matrix.toolchain }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        toolchain: [stable, beta]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install ${{ matrix.toolchain }}
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+      - run: cargo generate-lockfile
+        if: hashFiles('rust/Cargo.lock') == ''
+      # https://twitter.com/jonhoo/status/1571290371124260865
+      - name: cargo test
+        run: cargo test --locked --all-features --all-targets --workspace
+        working-directory: rust/
+      # https://github.com/rust-lang/cargo/issues/6669
+      - name: cargo test --doc
+        run: cargo test --locked --all-features --doc --workspace
+        working-directory: rust/
+
+  minimal:
+    name: ubuntu / stable / minimal-versions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install stable
+        uses: dtolnay/rust-toolchain@stable
+      - name: Install nightly for -Zminimal-versions
+        uses: dtolnay/rust-toolchain@nightly
+      - run: rustup default stable
+      - run: cargo +nightly update -Zminimal-versions --workspace
+        working-directory: rust/
+      - run: cargo test --locked --all-features --all-targets --workspace
+        working-directory: rust/
+
+  os-check:
+    name: ${{ matrix.os }} / stable
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          # NOTE: Don't use GitHub-hosted macOS runners in a non-public repository --
+          # they consume CI/CD minutes like crazy; see
+          # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#minute-multipliers
+          - windows-latest
+          #- macos-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Install stable
+        uses: dtolnay/rust-toolchain@stable
+      - run: cargo generate-lockfile
+        if: hashFiles('rust/Cargo.lock') == ''
+      - name: cargo test
+        run: cargo test --locked --all-features --all-targets --workspace
+        working-directory: rust/