diff --git a/.forgejo/workflows/runner-smoke.yml b/.forgejo/workflows/runner-smoke.yml
new file mode 100644
index 0000000..3266466
--- /dev/null
+++ b/.forgejo/workflows/runner-smoke.yml
@@ -0,0 +1,21 @@
+name: runner-smoke
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  smoke:
+    runs-on: codeberg-medium
+    steps:
+      - name: Basic runner + secret smoke test
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          echo "runner-ok"
+          if [[ -n "${CLOUDFLARE_API_TOKEN:-}" ]]; then
+            echo "secret-present"
+          else
+            echo "secret-missing"
+            exit 2
+          fi