diff --git a/.changeset/config.json b/.changeset/config.json
index 5d7c6032..3a592252 100644
--- a/.changeset/config.json
+++ b/.changeset/config.json
@@ -12,5 +12,9 @@
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [],
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  }
 }
diff --git a/.circleci/config.yml b/.circleci/config.yml
index c1e6cfff..1b21a61f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -10,44 +10,10 @@ parameters:
 orbs:
   publish-docs: infinitered/publish-docs@0.4
 
-# Docker defaults
-defaults: &defaults
-  docker:
-    - image: cimg/node:18.16.1
-  working_directory: /mnt/ramdisk/repo
-
-# Jobs
-jobs:
-  test_and_build:
-    <<: *defaults
-    steps:
-      - checkout
-      # Restore Yarn cache (Yarn 3 uses .yarn/cache directory)
-      - restore_cache:
-          name: Restore Yarn Cache
-          keys:
-            - yarn-cache-{{ checksum "yarn.lock" }}
-      - run:
-          name: Use local Yarn version
-          command: echo "export PATH=$(pwd)/.yarn/releases:$PATH" >> $BASH_ENV
-      - run:
-          name: Install Dependencies
-          command: yarn install --immutable
-      # Save Yarn cache
-      - save_cache:
-          name: Save Yarn Cache
-          key: yarn-cache-{{ checksum "yarn.lock" }}
-          paths:
-            - .yarn/cache
-      - run:
-          name: Lint code
-          command: yarn lint
-      - run:
-          name: Build modules and packages
-          command: yarn ci:build
-      - run:
-          name: Run tests
-          command: yarn test
+# Lint/build/test now live in GitHub Actions (.github/workflows/ci.yml) so that
+# pull requests and `main` run the exact same checks. CircleCI is kept solely
+# for docs publishing, which relies on the Infinite Red publish-docs orb and
+# CircleCI-managed SSH access to the ir-docs repo.
 
 # Publishing docs details
 publish-details: &publish-details
@@ -67,7 +33,6 @@ workflows:
   version: 2
   build-and-test:
     jobs:
-      - test_and_build
       - publish-docs/build_docs:
           <<: *publish-details
           filters:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..6d8b2a2c
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,61 @@
+name: CI
+
+# Single source of truth for the checks that gate the repo.
+#
+# This workflow runs on every pull request AND is called by the release
+# workflow (via `workflow_call`) before anything is versioned or published.
+# Running the exact same `verify` job in both places keeps PR and `main`
+# checks in lockstep, so a PR can't go green and then break on merge.
+
+on:
+  pull_request:
+  workflow_call:
+
+# Least privilege: this job only reads the repo to lint, build, and test.
+# No publishing or writes happen here (that stays in release.yml).
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    # Keep this name stable: it's referenced by the branch protection
+    # "required status checks" rule on main.
+    name: verify
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          # Full history so `changeset status` can find where the branch
+          # diverged from origin/main.
+          fetch-depth: 0
+
+      - name: Setup Node.js 18.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 18.x
+
+      - name: Install Dependencies
+        run: yarn install --immutable
+
+      # Requires a changeset for changed published packages and fails on
+      # changesets that reference a missing package (#247). Private packages
+      # (example-app, configs) are exempt via `privatePackages.version: false`
+      # in .changeset/config.json.
+      - name: Validate changesets
+        run: yarn changeset status --since=origin/main
+
+      # CI lints without mutating (eslint without --fix, prettier --check), so
+      # formatting drift fails the build. Locally `yarn lint` still auto-fixes.
+      - name: Lint code
+        run: yarn ci:lint
+
+      - name: Build modules and packages
+        run: yarn ci:build
+
+      - name: Run tests
+        run: yarn test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 088060d4..b0ffafe5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,13 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
+  # Run the same lint/changeset/build/test checks that gate every pull request
+  # (see ci.yml) before doing anything irreversible like versioning or
+  # publishing. This keeps `main` in lockstep with PRs.
+  verify:
+    name: "CI checks"
+    uses: ./.github/workflows/ci.yml
+
   version_or_release:
     # This job checks whether any changesets are present in './changesets'
     #
@@ -21,6 +28,7 @@ jobs:
     #    etc.
     #
     name: "Changesets version or release"
+    needs: verify
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
diff --git a/apps/ExampleApp/app/screens/TextRecognitionScreen.tsx b/apps/ExampleApp/app/screens/TextRecognitionScreen.tsx
index df574a3e..ee07d9e0 100644
--- a/apps/ExampleApp/app/screens/TextRecognitionScreen.tsx
+++ b/apps/ExampleApp/app/screens/TextRecognitionScreen.tsx
@@ -6,7 +6,10 @@ import { AppStackScreenProps } from "../navigators"
 import { Text, Icon, ImageSelector, Screen } from "../components"
 import { useTypedNavigation } from "../navigators/useTypedNavigation"
 
-import { recognizeText, Text as RecognizedText } from "@infinitered/react-native-mlkit-text-recognition"
+import {
+  recognizeText,
+  Text as RecognizedText,
+} from "@infinitered/react-native-mlkit-text-recognition"
 import { UseExampleImageStatus, SelectedImage } from "../utils/useExampleImage"
 
 type TextRecognitionScreenProps = NativeStackScreenProps<AppStackScreenProps<"TextRecognition">>
diff --git a/apps/ExampleApp/app/screens/index.ts b/apps/ExampleApp/app/screens/index.ts
index 52f2fb39..52018d68 100644
--- a/apps/ExampleApp/app/screens/index.ts
+++ b/apps/ExampleApp/app/screens/index.ts
@@ -7,4 +7,4 @@ export * from "./ImageLabelingScreen"
 export * from "./DocumentScannerScreen"
 export { BOX_COLORS } from "./FaceDetectionScreen"
 export * from "./ObjectDetectionScreen"
-export * from "./TextRecognitionScreen"
\ No newline at end of file
+export * from "./TextRecognitionScreen"
diff --git a/apps/ExampleApp/package.json b/apps/ExampleApp/package.json
index 0783ef09..00b3224d 100644
--- a/apps/ExampleApp/package.json
+++ b/apps/ExampleApp/package.json
@@ -6,7 +6,9 @@
   "scripts": {
     "compile": "tsc --noEmit -p . --pretty",
     "format": "prettier --write \"app/**/*.{js,jsx,json,md,ts,tsx}\"",
+    "format:check": "prettier --check \"app/**/*.{js,jsx,json,md,ts,tsx}\"",
     "lint": "eslint App.tsx app test --fix --ext .js,.ts,.tsx && npm run format",
+    "lint:ci": "eslint App.tsx app test --ext .js,.ts,.tsx && npm run format:check",
     "patch": "patch-package",
     "test": "jest",
     "test:watch": "jest --watch",
diff --git a/package.json b/package.json
index 8bbaa656..96c56072 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,7 @@
     "test": "turbo run test -- --run-in-band",
     "dev": "turbo run dev",
     "lint": "turbo run lint",
+    "ci:lint": "turbo run lint --filter=!example-app && yarn workspace example-app lint:ci",
     "clean": "turbo run clean --force",
     "format": "prettier --write \"**/*.{ts,tsx,md}\"",
     "setup": "./scripts/setup.sh",