diff --git a/.gitea/workflows/spire-identity-smoke.yml b/.gitea/workflows/spire-identity-smoke.yml
new file mode 100644
index 0000000..1d1c5d4
--- /dev/null
+++ b/.gitea/workflows/spire-identity-smoke.yml
@@ -0,0 +1,33 @@
+name: SPIRE identity smoke
+
+on:
+  workflow_dispatch:
+
+jobs:
+  jwt-svid:
+    runs-on: self-hosted
+    container:
+      volumes:
+        - /run/spire/agent-sockets:/run/spire/agent-sockets:ro
+    steps:
+      - name: Fetch pinned SPIRE CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive=/tmp/spire.tar.gz
+          curl --fail --location --silent --show-error \
+            --output "$archive" \
+            https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
+          printf '%s  %s\n' \
+            ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
+            "$archive" | sha256sum --check --status
+          tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent
+
+      - name: Fetch short-lived zot JWT-SVID
+        shell: bash
+        run: |
+          set -euo pipefail
+          /tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
+            -audience zot \
+            -socketPath /run/spire/agent-sockets/spire-agent.sock \
+            >/dev/null