diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1492b62..b7f6a46 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,20 +16,22 @@ jobs:
         with:
           node-version: '20'
           cache: 'npm'
+      - uses: extractions/setup-just@v4
       - run: npm ci
+      # Each step is a Justfile recipe, so `just ci` runs the same list locally.
       - name: Lint
-        run: npm run lint
+        run: just lint
       - name: Type check
-        run: npx tsc --noEmit
+        run: just typecheck
       - name: Unit tests
-        run: npm run test
+        run: just test
       - name: Cloudflare worker tests
-        # bash expands the globs; the workers have no dependencies to install.
-        run: node --test infra/cors-worker/*.test.mjs infra/cors-stats/*.test.mjs
+        # The workers have no dependencies to install.
+        run: just test-workers
       - name: Extension release script tests
-        run: node --test scripts/extension-release.test.mjs
+        run: just test-extension
       - name: Extension lint (AMO's unlisted rules)
-        run: npx --yes web-ext@10 lint --self-hosted --source-dir browser-extension
+        run: just lint-extension
 
   e2e-smoke:
     runs-on: ubuntu-latest
diff --git a/Justfile b/Justfile
new file mode 100644
index 0000000..8af6bf2
--- /dev/null
+++ b/Justfile
@@ -0,0 +1,49 @@
+# Common commands. App recipes delegate to package.json scripts (the source of
+# truth for how the app builds and tests); the rest are commands that otherwise
+# lived only in CI or in READMEs. `just ci` runs what the unit-tests CI job runs.
+
+default:
+    @just --list
+
+# Vite dev server (debug on)
+dev:
+    npm run dev
+
+build:
+    npm run build
+
+lint:
+    npm run lint
+
+typecheck:
+    npx tsc --noEmit
+
+# Jest unit tests
+test *args:
+    npm test -- {{args}}
+
+# Playwright e2e via scripts/run-e2e.js (per-worktree ports); pass spec paths to narrow
+e2e *args:
+    npm run test:e2e -- {{args}}
+
+# CORS proxy and stats workers (node --test)
+test-workers:
+    node --test infra/cors-worker/*.test.mjs infra/cors-stats/*.test.mjs
+
+test-extension:
+    node --test scripts/extension-release.test.mjs
+
+# AMO's rules for unlisted (self-hosted) Firefox add-ons
+lint-extension:
+    npx --yes web-ext@10 lint --self-hosted --source-dir browser-extension
+
+# Everything the unit-tests CI job runs, in the same order
+ci: lint typecheck test test-workers test-extension lint-extension
+
+# Deploy your own token-locked CORS proxy worker (Cloudflare auth required)
+deploy-proxy:
+    cd infra/cors-worker && npx wrangler deploy --env=""
+
+# Deploy the SHARED public proxy instance (maintainers only)
+deploy-proxy-public:
+    cd infra/cors-worker && npx wrangler deploy --env public
diff --git a/README.md b/README.md
index af06afc..4007344 100644
--- a/README.md
+++ b/README.md
@@ -223,6 +223,8 @@ This is a front end react app. Run like so:
 
 Then visit http://localhost:3000
 
+Common commands are also in the [Justfile](Justfile) (run `just` to list them). `just ci` runs exactly what the unit-test CI job runs.
+
 If you want to test PWA/production then do
 
 > npm run build:prod && npm run start
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index bff29d9..9244fd7 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -147,6 +147,11 @@ Key settings in `playwright.config.ts`:
 
 ## Common Development Tasks
 
+The repo-root `Justfile` collects the common commands (`just` lists them).
+App recipes delegate to the npm scripts. `just ci` runs the same steps, in the
+same order, as the `unit-tests` job in `.github/workflows/test.yml`, which calls
+each recipe directly. Any check added to CI should be added as a recipe and to `ci`.
+
 ### Fix Linting Issues
 
 ```bash