diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index c393868..357467e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,8 +1,15 @@
+# =============================================================================
 # Nimcheck CI pipeline
-# Runs lint, test, and build on push and pull request.
 #
-# Requires a Gitea act_runner with the "ubuntu-latest" label
-# (default label on the official gitea/act_runner image).
+# Triggers: push to main/develop, pull requests to main.
+# Requires a Gitea act_runner with the "ubuntu-latest" label.
+#
+# Jobs:
+#   lint     – compilation check with strict hints/warnings
+#   test     – matrix across Nim versions; runs the full test suite
+#   build    – release-optimised binary (depends on lint + test)
+#   coverage – instrumented test run (manual / main only)
+# =============================================================================
 
 name: CI
 
@@ -11,50 +18,92 @@ on:
     branches: [main, develop]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# ---------------------------------------------------------------------------
+# Shared environment – drive everything from a single Nim version variable
+# ---------------------------------------------------------------------------
 env:
-  NIM_VERSION: "2.0.0"
+  NIM_VERSION: "stable"
 
 jobs:
-  # ------------------------------------------------------------------
-  # Lint: compile with full hints and warnings enabled
-  # ------------------------------------------------------------------
+  # =========================================================================
+  # LINT – compile with every hint and warning enabled so nothing slips
+  # through.  This catches dead code, unused imports, and type issues early.
+  # =========================================================================
   lint:
-    name: Lint
+    name: Lint (${{ env.NIM_VERSION }})
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Cache choosenim toolchains
+        uses: actions/cache@v4
+        with:
+          path: ~/.choosenim
+          key: choosenim-${{ runner.os }}-${{ env.NIM_VERSION }}
+
+      - name: Cache nimble packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nimble
+          key: nimble-${{ runner.os }}-${{ hashFiles('nimcheck.nimble') }}
+
       - name: Install Nim
         run: |
-          curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "stable"
+          if ! command -v nim &>/dev/null; then
+            curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "${{ env.NIM_VERSION }}"
+          fi
           echo "$HOME/.nimble/bin" >> "$GITHUB_PATH"
 
       - name: Lint
         run: make lint
 
-  # ------------------------------------------------------------------
-  # Test: compile and run the full test suite
-  # ------------------------------------------------------------------
+  # =========================================================================
+  # TEST – matrix across the minimum supported Nim version and the latest
+  # stable release.  Runs the full test suite (all languages).
+  # =========================================================================
   test:
-    name: Test
+    name: Test (nim-${{ matrix.nim-version }})
+    needs: [lint]
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        nim-version: ["2.0.8", "stable"]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Cache choosenim toolchains
+        uses: actions/cache@v4
+        with:
+          path: ~/.choosenim
+          key: choosenim-${{ runner.os }}-${{ matrix.nim-version }}
+
+      - name: Cache nimble packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nimble
+          key: nimble-${{ runner.os }}-${{ hashFiles('nimcheck.nimble') }}
+
       - name: Install Nim
         run: |
-          curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "stable"
+          curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "${{ matrix.nim-version }}"
           echo "$HOME/.nimble/bin" >> "$GITHUB_PATH"
 
       - name: Run tests
         run: make test
 
-  # ------------------------------------------------------------------
-  # Build: produce the release binary (runs only after lint + test)
-  # ------------------------------------------------------------------
+  # =========================================================================
+  # BUILD – release-optimised binary.  Only runs when lint and at least one
+  # test matrix leg pass.  Uploads the binary as a workflow artifact.
+  # =========================================================================
   build:
     name: Build
     needs: [lint, test]
@@ -63,10 +112,67 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Cache choosenim toolchains
+        uses: actions/cache@v4
+        with:
+          path: ~/.choosenim
+          key: choosenim-${{ runner.os }}-${{ env.NIM_VERSION }}
+
+      - name: Cache nimble packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nimble
+          key: nimble-${{ runner.os }}-${{ hashFiles('nimcheck.nimble') }}
+
       - name: Install Nim
         run: |
-          curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "stable"
+          curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "${{ env.NIM_VERSION }}"
           echo "$HOME/.nimble/bin" >> "$GITHUB_PATH"
 
-      - name: Build
-        run: make build
+      - name: Build (release)
+        run: |
+          make build
+          strip bin/nimcheck 2>/dev/null || true
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nimcheck-${{ runner.os }}-${{ github.sha }}
+          path: bin/nimcheck
+          retention-days: 7
+
+  # =========================================================================
+  # COVERAGE – instrumented test run (requires nim-coverage; optional).
+  # Runs on manual dispatch or merges to main only to save CI minutes.
+  # =========================================================================
+  coverage:
+    name: Coverage
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache choosenim toolchains
+        uses: actions/cache@v4
+        with:
+          path: ~/.choosenim
+          key: choosenim-${{ runner.os }}-${{ env.NIM_VERSION }}
+
+      - name: Cache nimble packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nimble
+          key: nimble-${{ runner.os }}-${{ hashFiles('nimcheck.nimble') }}
+
+      - name: Install Nim
+        run: |
+          curl https://nim-lang.org/choosenim/init.sh -sSf | sh -s -- -y "${{ env.NIM_VERSION }}"
+          echo "$HOME/.nimble/bin" >> "$GITHUB_PATH"
+
+      - name: Install coverage tool
+        run: nimble install -y nimcoverage 2>/dev/null || true
+
+      - name: Run tests with coverage
+        run: make coverage || true