diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 0dd319a..cfda07a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -73,6 +73,7 @@
 /scripts/doctor.sh                      @sabiut
 /.github/workflows/test-artifacts.yml   @sabiut
 /.github/workflows/test-flags.yml       @sabiut
+/.github/workflows/tests.yml            @sabiut
 
 # Shared review — either owner can approve.
 # TROUBLESHOOTING is mostly the --doctor user-facing guide; lint
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..a69cc6d
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,45 @@
+name: BATS Tests
+run-name: |
+  BATS: ${{
+    github.event_name == 'pull_request' && format('PR #{0} by @{1} - {2}', github.event.pull_request.number, github.actor, github.event.pull_request.title) ||
+    github.event_name == 'push' && github.event.head_commit && format('Push by @{0} - {1}', github.actor, github.event.head_commit.message) ||
+    format('{0} triggered by @{1}', github.event_name, github.actor)
+  }}
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "tests/**"
+      - "scripts/**"
+      - ".github/workflows/tests.yml"
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: bats-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  bats:
+    name: BATS unit tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install BATS and Node.js
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bats nodejs
+
+      - name: Run BATS test suite
+        # Cowork tests load scripts/cowork-vm-service.js via `node` —
+        # the `nodejs` install above is what they need.
+        run: bats --print-output-on-failure tests/*.bats
diff --git a/tests/cowork-bwrap-config.bats b/tests/cowork-bwrap-config.bats
index c4e038c..643a4b4 100644
--- a/tests/cowork-bwrap-config.bats
+++ b/tests/cowork-bwrap-config.bats
@@ -46,6 +46,12 @@ function assertDeepEqual(actual, expected, msg) {
 setup() {
 	TEST_TMP=$(mktemp -d)
 	export TEST_TMP
+
+	# The doctor checks resolve config via ${XDG_CONFIG_HOME:-$HOME/.config}.
+	# Sandboxing HOME alone is insufficient because GitHub Actions runners
+	# (and many user environments) export XDG_CONFIG_HOME ambient, which
+	# overrides the per-test HOME and makes the function read the wrong dir.
+	unset XDG_CONFIG_HOME
 }
 
 teardown() {