diff --git a/.github/workflows/test-main.yml b/.github/workflows/test-main.yml
new file mode 100644
index 0000000..75c3dee
--- /dev/null
+++ b/.github/workflows/test-main.yml
@@ -0,0 +1,39 @@
+name: Test against SDK main
+
+# Exercises the example app against the unreleased Castle Ruby SDK (main
+# branch). This is the permanent test/sdk-main branch: every push to it runs
+# the suite against the latest main. Nightly/manual runs require this file to
+# also live on the default branch (GitHub only honours schedule/workflow_dispatch
+# from the default branch).
+on:
+  push:
+    branches: [test/sdk-main]
+  workflow_dispatch:
+  schedule:
+    - cron: "0 6 * * *"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: false
+
+      - name: Point the app at the SDK main branch
+        run: ./scripts/set-sdk-version.sh main
+
+      - name: Install dependencies
+        run: bundle install
+
+      - name: Set up the test database
+        run: |
+          cp config/database.yml.example config/database.yml
+          bundle exec rails db:test:prepare
+
+      - name: Run the test suite
+        run: bundle exec rspec
diff --git a/scripts/set-sdk-version.sh b/scripts/set-sdk-version.sh
new file mode 100755
index 0000000..940b6c0
--- /dev/null
+++ b/scripts/set-sdk-version.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Point the example app at a specific Castle Ruby SDK source.
+#
+#   set-sdk-version.sh main      -> track the SDK's main branch (pre-release testing)
+#   set-sdk-version.sh 9.3.0     -> pin the released ~> 9.3 gem from RubyGems
+#
+# Rewrites the castle-rb line in the Gemfile and regenerates Gemfile.lock.
+set -euo pipefail
+
+target="${1:?usage: set-sdk-version.sh <main|X.Y.Z>}"
+
+ruby - "$target" <<'RUBY'
+target = ARGV[0]
+path = "Gemfile"
+content = File.read(path)
+pattern = /^\s*gem ['"]castle-rb['"].*$/
+abort "no castle-rb gem line found in #{path}" unless content.match?(pattern)
+line =
+  if target == "main"
+    "gem 'castle-rb', github: 'castle/castle-ruby', branch: 'main'"
+  else
+    minor = target.split(".")[0, 2].join(".")
+    "gem 'castle-rb', '~> #{minor}'"
+  end
+File.write(path, content.gsub(pattern, line))
+RUBY
+
+bundle lock