diff --git a/ci.cue b/ci.cue
new file mode 100644
index 0000000000..bdc9d1da29
--- /dev/null
+++ b/ci.cue
@@ -0,0 +1,136 @@
+ci: {
+    version: 1
+    steps: {
+        nixexpr: {
+          label: "ensure Nix expressions are up-to-date"
+          command: [ "./update-nix.sh", "--check" ]
+          outputs: [
+              "/local/repo/nix-expr.patch",
+          ]
+        }
+        scalafix: {
+            label:   "scalafix & scalafmt"
+            command: #sbt + ["formatCheck"]
+        }
+        compile: {
+            label:   "compile everything"
+            command: #sbt + ["compile-all"]
+            after: ["scalafix"]
+        }
+        scalastyle: {
+            command: #sbt + ["coverage", "scalastyle", "test:scalastyle"]
+            after: ["compile"]
+        }
+        test_bytes: {
+            label: "bytes tests"
+            after: ["compile"]
+            command: #sbt + ["coverage", "bytes/test"]
+            outputs: [
+                "/local/repo/bytes/target/test-reports/**/*",
+                "/local/repo/bytes/target/scala-2.13/scoverage-report/**/*",
+                "/local/repo/bytes/target/scala-2.13/coverage-report/**/*",
+            ]
+        }
+        test_crypto: {
+            label: "Crypto tests"
+            after: ["compile"]
+            command: #sbt + ["coverage", "crypto/test"]
+            outputs: [
+                "/local/repo/crypto/target/test-reports/**/*",
+                "/local/repo/crypto/target/scala-2.13/scoverage-report/**/*",
+                "/local/repo/crypto/target/scala-2.13/coverage-report/**/*",
+            ]
+        }
+        test_rlp: {
+            label: "RLP tests"
+            after: ["compile"]
+            command: #sbt + ["coverage", "rlp/test"]
+            outputs: [
+                "/local/repo/rlp/target/test-reports/**/*",
+                "/local/repo/rlp/target/scala-2.13/scoverage-report/**/*",
+                "/local/repo/rlp/target/scala-2.13/coverage-report/**/*",
+            ]
+        }
+        test_unit: {
+            label: "Unit tests"
+            after: ["compile"]
+            command: #sbt + ["coverage", "test"]
+            outputs: [
+                "/local/repo/target/test-reports/**/*",
+                "/local/repo/target/scala-2.13/scoverage-report/**/*",
+                "/local/repo/target/scala-2.13/coverage-report/**/*",
+            ]
+        }
+        test_evm: {
+            label: "EVM tests"
+            after: ["compile"]
+            command: #sbt + ["coverage", "evm:test"]
+            outputs: [
+                "/local/repo/target/test-reports/**/*",
+                "/local/repo/target/scala-2.13/scoverage-report/**/*",
+                "/local/repo/target/scala-2.13/coverage-report/**/*",
+            ]
+        }
+        test_ets: {
+            label: "ETS tests"
+            after: ["compile"]
+            command: ["./test-ets-bitte.sh"]
+            outputs: [
+                "/local/repo/mantis-log.txt",
+                "/local/repo/retesteth-GeneralStateTests-log.txt",
+                "/local/repo/retesteth-BlockchainTests-log.txt",
+            ]
+        }
+        test_integration: {
+            label: "integration tests"
+            after: ["compile"]
+            command: #sbt + ["coverageOff", "it:test"]
+            outputs: [
+                "/local/repo/target/test-reports/**/*",
+            ]
+        }
+        additional: {
+            label: "additional compilation & dist"
+            after: ["compile", "test_integration"]
+            command: #sbt + ["coverageOff", "benchmark:compile dist"]
+            outputs: [
+                "/local/repo/target/universal/mantis-*.zip",
+            ]
+        }
+        publish: {
+            label: "Publishing libraries to Maven"
+            after: ["test_crypto", "test_rlp", "test_unit"]
+            command: [ ".buildkite/publish.sh" ] // TODO
+            outputs: [
+                "/local/repo/target/universal/mantis-*.zip",
+            ]
+        }
+    }
+}
+// #sbt: ["sbt", "-v", "-mem", "2048", "-J-Xmx4g", "-Dsbt.ivy.home=/cache/ivy2", "-Dsbt.boot.directory=/cache/sbt", "-Dmaven.repo.local=/cache/maven", "-Dnix=true"]
+#sbt: ["sbt", "-v", "-mem", "8192", "-Dnix=true"]
+
+// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#webhook-payload-object-33
+#isNotDraft: pull_request.draft == false
+
+// shared defaults for all steps
+#step: {
+    enable:       pull_request.base.ref == "develop" && #isNotDraft
+    cpu:          5000
+    memory:       9000
+    term_timeout: 60 * 60 * 3
+    kill_timeout: term_timeout + 30
+    flakes: "github:input-output-hk/mantis": [
+        "sbt",
+        "coreutils",
+        "gnused",
+        "gnupg",
+        "solc",
+        "lllc",
+        "jdk8",
+        "retesteth",
+        "netcat-gnu",
+        "gnugrep",
+        "protoc-wrapper",
+    ]
+}
diff --git a/nix/overlay.nix b/nix/overlay.nix
index ad4173cf4e..4624035a6d 100644
--- a/nix/overlay.nix
+++ b/nix/overlay.nix
@@ -42,4 +42,5 @@ rev: final: prev: {
 
   retesteth = final.callPackage ./retesteth.nix { };
   lllc = final.callPackage ./lllc.nix { };
+  protoc-wrapper = final.callPackage ./protoc-wrapper.nix { };
 }
diff --git a/nix/protoc-wrapper.nix b/nix/protoc-wrapper.nix
new file mode 100644
index 0000000000..f87340651a
--- /dev/null
+++ b/nix/protoc-wrapper.nix
@@ -0,0 +1,16 @@
+{ pkgs }:
+  # TODO, share this code with mantis build in this project
+  # sbt-protoc puts the scala plugin in /tmp/protobridge<some-random-number>.
+  # it is in fact a shell script with a standard `#!/usr/bin/env sh` shebang
+  # that makes the Nix sandbox ANGRY and breaks all the things in a cryptic,
+  # hairpull-inducing way. So we gotta sed it out. Not the prettiest thing
+  # but it works.
+  pkgs.writeShellScriptBin "protoc" ''
+    set -e
+
+    for f in "$@"; do
+      echo ''${f##*=}
+    done | grep protocbridge | xargs sed -i "1s|.*|#!${pkgs.bash}/bin/bash|"
+
+    exec ${pkgs.protobuf}/bin/protoc "$@"
+  ''
diff --git a/test-ets-bitte.sh b/test-ets-bitte.sh
new file mode 100755
index 0000000000..665d679c25
--- /dev/null
+++ b/test-ets-bitte.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+git submodule init
+git submodule update
+
+echo "booting Mantis and waiting for RPC API to be up"
+$SBT -Dconfig.file=./src/main/resources/conf/testmode.conf run &> mantis-log.txt &
+
+while ! nc -z localhost 8546; do   
+  sleep 0.1
+done
+
+final_exit_code=0
+
+function run {
+  echo "running retesteth $1"
+  ets/retesteth -t "$1" &> "retesteth-$1-log.txt"
+  exit_code=$?
+  echo "retesteth $1 exit code: $exit_code"
+}
+
+run "GeneralStateTests"
+run "BlockchainTests"
+
+echo "shutting down mantis"
+kill %1
+
+exit $final_exit_code