diff --git a/.github/workflows/test-main.yml b/.github/workflows/test-main.yml
new file mode 100644
index 0000000..5cbe898
--- /dev/null
+++ b/.github/workflows/test-main.yml
@@ -0,0 +1,36 @@
+name: Test against SDK main
+
+# Exercises the example app against the unreleased Castle Python SDK (main
+# branch). This is the permanent test/sdk-main branch: every push to it runs
+# the suite against the latest main. Nightly/manual runs require this file to
+# also live on the default branch (GitHub only honours schedule/workflow_dispatch
+# from the default branch).
+on:
+  push:
+    branches: [test/sdk-main]
+  workflow_dispatch:
+  schedule:
+    - cron: "0 6 * * *"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Point the app at the SDK main branch
+        run: ./scripts/set-sdk-version.sh main
+
+      - run: pip install -r requirements-dev.txt
+
+      - name: Byte-compile sources
+        run: python -m py_compile app.py castle_config.py demo_config.py
+
+      - name: Run tests
+        run: pytest
diff --git a/scripts/set-sdk-version.sh b/scripts/set-sdk-version.sh
new file mode 100755
index 0000000..7c48815
--- /dev/null
+++ b/scripts/set-sdk-version.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Point the example app at a specific Castle Python SDK source.
+#
+#   set-sdk-version.sh main      -> track the SDK's main branch (pre-release testing)
+#   set-sdk-version.sh 7.3.0     -> pin the released >=7.3.0,<8 package from PyPI
+#
+# Rewrites the castle requirement in requirements.txt.
+set -euo pipefail
+
+target="${1:?usage: set-sdk-version.sh <main|X.Y.Z>}"
+
+python3 - "$target" <<'PY'
+import re
+import sys
+
+target = sys.argv[1]
+path = "requirements.txt"
+with open(path) as f:
+    content = f.read()
+
+if target == "main":
+    line = "castle @ git+https://github.com/castle/castle-python.git@main"
+else:
+    major = int(target.split(".")[0])
+    line = f"castle>={target},<{major + 1}"
+
+updated, count = re.subn(r"^castle\b.*$", line, content, flags=re.M)
+if count == 0:
+    sys.exit("no castle requirement found in requirements.txt")
+with open(path, "w") as f:
+    f.write(updated)
+PY