diff --git a/.clang-tidy b/.clang-tidy
index cefd2c6..5246243 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -2,29 +2,20 @@
 Checks: >
     -*,
     bugprone-*,
+    -bugprone-easily-swappable-parameters,
+    -bugprone-narrowing-conversions,
+    -bugprone-implicit-widening-of-multiplication-result,
     clang-analyzer-*,
-    modernize-*,
-    -modernize-use-trailing-return-type,
-    performance-*,
-    readability-braces-around-statements,
+    cppcoreguidelines-init-variables,
+    misc-no-recursion,
+    concurrency-mt-unsafe,
     readability-else-after-return,
-    readability-identifier-naming,
+    readability-make-member-function-const,
     readability-redundant-*,
     readability-simplify-*,
-CheckOptions:
-    readability-identifier-naming.ClassCase: CamelCase
-    readability-identifier-naming.EnumCase: CamelCase
-    readability-identifier-naming.FunctionCase: camelBack
-    readability-identifier-naming.MemberCase: camelBack
-    readability-identifier-naming.MemberPrefix: m_
-    readability-identifier-naming.MethodCase: camelBack
-    readability-identifier-naming.NamespaceCase: CamelCase
-    readability-identifier-naming.ParameterCase: camelBack
-    readability-identifier-naming.PrivateMemberPrefix: m_
-    readability-identifier-naming.StaticConstantCase: UPPER_CASE
-    readability-identifier-naming.StaticConstantPrefix: k
-    readability-identifier-naming.VariableCase: camelBack
-WarningsAsErrors: "*"
+    modernize-use-override,
+    modernize-use-nullptr,
+    modernize-deprecated-headers,
 HeaderFilterRegex: ".*"
 FormatStyle: file
 
diff --git a/.gitea/workflows/ci-image.yml b/.gitea/workflows/ci-image.yml
new file mode 100644
index 0000000..cf2f52c
--- /dev/null
+++ b/.gitea/workflows/ci-image.yml
@@ -0,0 +1,22 @@
+name: Rebuild CI Image
+
+on:
+    schedule:
+        - cron: '0 6 * * 1'
+    workflow_dispatch:
+
+jobs:
+    build:
+        runs-on: alpine
+        env:
+            IMAGE: git.aramjonghu.nl/aramjonghu/zshell-ci:latest
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Build image
+              run: docker build -t "$IMAGE" -f ci/Dockerfile .
+
+            - name: Push image
+              run: docker push "$IMAGE"
diff --git a/.gitea/workflows/cpp.yml b/.gitea/workflows/cpp.yml
new file mode 100644
index 0000000..ffe41a3
--- /dev/null
+++ b/.gitea/workflows/cpp.yml
@@ -0,0 +1,29 @@
+name: C++
+
+on:
+    pull_request:
+
+jobs:
+    build:
+        runs-on: alpine
+        container:
+            image: git.aramjonghu.nl/aramjonghu/zshell-ci:latest
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Configure
+              run: cmake -B build -G Ninja -DENABLE_MODULES=plugin -DCMAKE_BUILD_TYPE=Release
+
+            - name: Build
+              run: ninja -C build
+
+            - name: clang-tidy
+              continue-on-error: true
+              run: |
+                  set -o pipefail
+                  run-clang-tidy -p build -j $(nproc) -header-filter="Plugins/.*" 2>&1 | \
+                    grep -v 'Suppressed\|non-user\|non-system\|unknown argument.*mno-direct'
diff --git a/ci/Dockerfile b/ci/Dockerfile
new file mode 100644
index 0000000..dd94cce
--- /dev/null
+++ b/ci/Dockerfile
@@ -0,0 +1,43 @@
+FROM archlinux:latest
+
+RUN pacman -Syu --noconfirm
+
+# Build toolchain
+RUN pacman -S --noconfirm \
+    base-devel \
+    cmake \
+    ninja \
+    clang \
+    lld \
+    nodejs \
+    git
+
+# Qt6
+RUN pacman -S --noconfirm \
+    qt6-base \
+    qt6-declarative \
+    qt6-shadertools \
+    qt6-5compat \
+    qt6-canvaspainter
+
+# Project-specific dependencies
+RUN pacman -S --noconfirm \
+    libqalculate \
+    pipewire \
+    aubio \
+    cava \
+    lm_sensors \
+    glib2
+
+# AUR: libcava (provides development headers for cava)
+RUN pacman -S --needed --noconfirm sudo && \
+    useradd -m builder && \
+    echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    su builder -c " \
+        git clone https://aur.archlinux.org/libcava.git /tmp/libcava && \
+        cd /tmp/libcava && \
+        makepkg -si --noconfirm \
+    " && \
+    rm -rf /tmp/libcava && \
+    userdel -r builder && \
+    sed -i '/^builder/d' /etc/sudoers