diff --git a/.github/workflows/freeze-envelope.yml b/.github/workflows/freeze-envelope.yml
deleted file mode 100644
index fea1da7..0000000
--- a/.github/workflows/freeze-envelope.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Freeze Envelope Byte Contract
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  freeze-envelope:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Assert EventEnvelope byte contract
-        run: cargo test -p vaultmesh-command-center test_event_envelope_canonicalization_bytes
-
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..821c6ca
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,20 @@
+stages:
+  - test
+
+freeze:envelope-byte-contract:
+  stage: test
+  image: rust:stable
+  variables:
+    CARGO_TERM_COLOR: always
+  cache:
+    key: cargo
+    paths:
+      - target/
+      - .cargo/registry/
+      - .cargo/git/
+  before_script:
+    - rustc --version
+    - cargo --version
+  script:
+    - cargo test -p vaultmesh-command-center test_event_envelope_canonicalization_bytes
+
diff --git a/COOLING_CHECKLIST.md b/COOLING_CHECKLIST.md
index b0e08ad..77adb89 100644
--- a/COOLING_CHECKLIST.md
+++ b/COOLING_CHECKLIST.md
@@ -5,5 +5,6 @@ For the next 30 days, treat these as frozen invariants: do not change `EventEnve
 No envelope changes without: a payload schema bump, a full replay audit rerun, and a new freeze tag.
 
 Freeze tag: `v0.8-freeze-envelope-v0` currently exists locally; when ready to publish, push it (and the commit) with:
-- `git push origin 1830e0f:main`
-- `git push origin v0.8-freeze-envelope-v0`
+- `git remote add gitlab <gitlab-repo-url>` (one-time)
+- `git push gitlab main`
+- `git push gitlab v0.8-freeze-envelope-v0`