diff --git a/.github/workflows/test-main.yml b/.github/workflows/test-main.yml
new file mode 100644
index 0000000..9c1858b
--- /dev/null
+++ b/.github/workflows/test-main.yml
@@ -0,0 +1,40 @@
+name: Test against SDK main
+
+# Exercises the example app against the unreleased Castle PHP SDK (main
+# branch). This is the permanent test/sdk-main branch: every push to it runs
+# the suite against the latest main. Nightly/manual runs require this file to
+# also live on the default branch (GitHub only honours schedule/workflow_dispatch
+# from the default branch).
+on:
+  push:
+    branches: [test/sdk-main]
+  workflow_dispatch:
+  schedule:
+    - cron: "0 6 * * *"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          extensions: curl, json
+          tools: composer
+
+      - name: Point the app at the SDK main branch
+        run: ./scripts/set-sdk-version.sh main
+
+      - name: Install dependencies
+        run: composer update castle/castle-php --no-interaction --no-progress
+
+      - name: Lint sources
+        run: |
+          find . -path ./vendor -prune -o -name '*.php' -print | xargs -n1 -P4 php -l
+
+      - name: Run tests
+        run: composer test
diff --git a/scripts/set-sdk-version.sh b/scripts/set-sdk-version.sh
new file mode 100755
index 0000000..e9bc369
--- /dev/null
+++ b/scripts/set-sdk-version.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Point the example app at a specific Castle PHP SDK source.
+#
+#   set-sdk-version.sh main      -> track the SDK's main branch (pre-release testing)
+#   set-sdk-version.sh 4.1.0     -> pin the released ^4.1 package from Packagist
+#
+# Rewrites the castle/castle-php constraint in composer.json.
+set -euo pipefail
+
+target="${1:?usage: set-sdk-version.sh <main|X.Y.Z>}"
+
+python3 - "$target" <<'PY'
+import json
+import sys
+
+target = sys.argv[1]
+path = "composer.json"
+with open(path) as f:
+    data = json.load(f)
+
+if target == "main":
+    data["require"]["castle/castle-php"] = "dev-main"
+else:
+    major, minor = target.split(".")[:2]
+    data["require"]["castle/castle-php"] = f"^{major}.{minor}"
+
+with open(path, "w") as f:
+    json.dump(data, f, indent=2)
+    f.write("\n")
+PY