diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100755
index 0000000..1730c57
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Versioned pre-push hook. The server runs no CI, so the local gate runs here.
+# Enable once per clone:   git config core.hooksPath .githooks
+# Skip only deliberately:  git push --no-verify
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+exec scripts/check.sh
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 042f05e..18b0611 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -37,6 +37,17 @@ dependencies are not accepted without prior discussion.
 
 ## Tests
 
+The server runs no CI. The gate is `scripts/check.sh`, run by the versioned
+`pre-push` hook once you enable it in your clone:
+
+```bash
+git config core.hooksPath .githooks
+```
+
+Skip it only deliberately with `git push --no-verify`, and say why in the
+commit message. The workflows in `.gitea/workflows` are ready for a Gitea 1.21
+or later with a runner; until then they do not run.
+
 ```bash
 ./scripts/check.sh                     # everything ci.yml runs, on any machine; run before pushing
 go test -race ./...