diff --git a/.github/cnti/cnti-testsuite.yaml b/.github/cnti/cnti-testsuite.yaml
new file mode 100644
index 00000000..4cb0804d
--- /dev/null
+++ b/.github/cnti/cnti-testsuite.yaml
@@ -0,0 +1,18 @@
+# CNTi Test Suite configuration for the essential tests run by
+# .github/workflows/cnti.yml. The chart is installed with its defaults; the
+# only settings are the released image tags the rolling update, downgrade
+# and rollback tests move to.
+---
+config_version: "v2"
+common:
+  container_names:
+    - name: eupf
+      rolling_update_test_tag: "0.7.0"
+      rolling_downgrade_test_tag: "0.6.4"
+      rolling_version_change_test_tag: "0.7.0"
+      rollback_from_tag: "0.7.0"
+deployments:
+  helm_dirs:
+    - name: eupf
+      helm_directory: ../../.deploy/helm/eupf
+      namespace: eupf
diff --git a/.github/cnti/kind.yaml b/.github/cnti/kind.yaml
new file mode 100644
index 00000000..ab0b0581
--- /dev/null
+++ b/.github/cnti/kind.yaml
@@ -0,0 +1,17 @@
+# kind cluster for the CNTi essential tests: a control plane and two workers,
+# so node_drain has somewhere to move eUPF. The chart sets the unsafe sysctl
+# net.ipv4.ip_forward, which every kubelet has to allow, or the pod is
+# rejected at admission (see the chart README).
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+  - role: control-plane
+    kubeadmConfigPatches: &allow-ip-forward
+      - |
+        kind: KubeletConfiguration
+        allowedUnsafeSysctls:
+          - "net.ipv4.ip_forward"
+  - role: worker
+    kubeadmConfigPatches: *allow-ip-forward
+  - role: worker
+    kubeadmConfigPatches: *allow-ip-forward
diff --git a/.github/workflows/cnti.yml b/.github/workflows/cnti.yml
new file mode 100644
index 00000000..2c3d265a
--- /dev/null
+++ b/.github/workflows/cnti.yml
@@ -0,0 +1,74 @@
+# Installs the eUPF chart with its defaults on a kind cluster every night,
+# runs the CNTi Test Suite's essential tests against it and publishes the
+# result as the badge in the README. https://github.com/lfn-cnti/testsuite-action
+#
+# For problems with the action or the test suite, open an issue at
+# https://github.com/lfn-cnti/testsuite-action/issues
+name: CNTi essential
+
+on:
+  schedule:
+    # Off the full hour: GitHub delays or drops scheduled runs under load,
+    # which peaks at the start of each hour.
+    - cron: "37 3 * * *"
+  # By hand, and on pull requests that change the job, its configuration or
+  # the chart.
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/cnti.yml
+      - .github/cnti/**
+      - .deploy/helm/eupf/**
+
+permissions:
+  contents: read
+
+jobs:
+  # The nightly run and manual runs on main: the only runs that publish the
+  # badge, and the only ones with a write token. Forks that enable scheduled
+  # workflows do not run either job.
+  essential:
+    if: github.repository == 'edgecomllc/eupf' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      # Publishes the badge to the orphan branch `badges`.
+      contents: write
+    steps: &essential-steps
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The suite doesn't need the job's write token; the action passes it
+          # to the badge publisher on its own.
+          persist-credentials: false
+
+      - uses: lfn-cnti/testsuite-action@70536fda55fcb11f4f7463175fe9d57c86b85574 # v1.2.0
+        with:
+          # A released suite version, bumped on purpose after reading the
+          # release notes.
+          version: v2.3.0
+          cnf_config: .github/cnti/cnti-testsuite.yaml
+          kind_config: .github/cnti/kind.yaml
+          tests: cert
+          badge_branch: badges
+
+      # Why did eUPF not come up? Pod state, events and logs from the kind
+      # cluster the action created; it lives until the job ends.
+      - name: Diagnostics
+        if: failure()
+        run: |
+          set +e
+          kubectl get pods -A -o wide
+          kubectl describe pods -n eupf | tail -80
+          kubectl logs -n eupf --all-containers --tail=60 -l app.kubernetes.io/name=eupf
+          kubectl get events -n eupf --sort-by=.lastTimestamp | tail -40
+
+  # Pull requests that change the job or its configuration, and manual runs on
+  # other branches: the same steps with a read-only token. The action publishes
+  # the badge only from the default branch, so nothing is published here.
+  essential-pr:
+    if: github.repository == 'edgecomllc/eupf' && (github.event_name == 'pull_request' || github.ref != 'refs/heads/main')
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    steps: *essential-steps
diff --git a/README.md b/README.md
index f013ddfd..0a953cf8 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,7 @@
 [![Build][build-img]][build]
 [![Test][test-img]][test]
 [![Security][security-test-img]][security-test]
+[![CNTi essential][cnti-img]][cnti]
 [![License: Apache-2.0][license-img]][license]
 
 </div>
@@ -264,5 +265,7 @@ This project is licensed under the [Apache-2.0 Creative Commons License](https:/
 [test-img]: https://github.com/edgecomllc/eupf/actions/workflows/test.yml/badge.svg
 [security-test]: https://github.com/edgecomllc/eupf/actions/workflows/security-scan.yml
 [security-test-img]: https://github.com/edgecomllc/eupf/actions/workflows/security-scan.yml/badge.svg
+[cnti]: https://github.com/edgecomllc/eupf/actions/workflows/cnti.yml
+[cnti-img]: https://github.com/edgecomllc/eupf/raw/badges/cnti-badge.svg
 [license]: https://github.com/edgecomllc/eupf/blob/main/LICENSE
 [license-img]: https://img.shields.io/badge/License-Apache%202.0-blue.svg