diff --git a/.github/workflows/ml-kem.yml b/.github/workflows/ml-kem.yml
new file mode 100644
index 0000000..6281f8b
--- /dev/null
+++ b/.github/workflows/ml-kem.yml
@@ -0,0 +1,97 @@
+name: ml-kem
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/ml-kem.yml"
+      - "ml-kem/**"
+      - "Cargo.*"
+  push:
+    branches: master
+
+defaults:
+  run:
+    working-directory: ml-kem
+
+env:
+  RUSTFLAGS: "-Dwarnings"
+  CARGO_INCREMENTAL: 0
+
+jobs:
+  set-msrv:
+    uses: RustCrypto/actions/.github/workflows/set-msrv.yml@master
+    with:
+      msrv: 1.74.0
+
+# TODO
+#  no_std:
+#    needs: set-msrv
+#    runs-on: ubuntu-latest
+#    strategy:
+#      matrix:
+#        rust:
+#          - ${{needs.set-msrv.outputs.msrv}}
+#          - stable
+#        target:
+#          - thumbv7em-none-eabi
+#          - wasm32-unknown-unknown
+#    steps:
+#      - uses: actions/checkout@v4
+#      - uses: RustCrypto/actions/cargo-cache@master
+#      - uses: dtolnay/rust-toolchain@master
+#        with:
+#          toolchain: ${{ matrix.rust }}
+#          targets: ${{ matrix.target }}
+#      - run: cargo build --no-default-features --target ${{ matrix.target }}
+
+# TODO
+#  minimal-versions:
+#    uses: RustCrypto/actions/.github/workflows/minimal-versions.yml@master
+#    with:
+#      working-directory: ${{ github.workflow }}
+
+  test:
+    needs: set-msrv
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust:
+          - ${{needs.set-msrv.outputs.msrv}}
+          - stable
+    steps:
+      - uses: actions/checkout@v4
+      - uses: RustCrypto/actions/cargo-cache@master
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.rust }}
+      - run: cargo build --all-features
+      # TODO(tarcieri): remove cargo build, run cargo test
+      #- run: cargo test --no-default-features
+      #- run: cargo test
+      #- run: cargo test --all-features
+
+# TODO(tarcieri): miri
+#  miri:
+#    runs-on: ubuntu-latest
+#    env:
+#      MIRIFLAGS: "-Zmiri-symbolic-alignment-check -Zmiri-strict-provenance"
+#    strategy:
+#      matrix:
+#        target:
+#          - x86_64-unknown-linux-gnu
+#          - s390x-unknown-linux-gnu
+#    steps:
+#      - uses: actions/checkout@v4
+#      - uses: RustCrypto/actions/cargo-cache@master
+#      - uses: dtolnay/rust-toolchain@master
+#        with:
+#          toolchain: nightly
+#      - name: Install Miri
+#        run: |
+#          rustup component add miri
+#          cargo miri setup
+#      - name: Test with Miri
+#        run: |
+#          cargo miri test --target ${{ matrix.target }} --no-default-features
+#          cargo miri test --target ${{ matrix.target }}
+#          cargo miri test --target ${{ matrix.target }} --all-features
diff --git a/.github/workflows/workspace.yml b/.github/workflows/workspace.yml
new file mode 100644
index 0000000..f36df4f
--- /dev/null
+++ b/.github/workflows/workspace.yml
@@ -0,0 +1,44 @@
+name: Workspace
+
+on:
+  pull_request:
+    paths-ignore:
+      - README.md
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - README.md
+
+env:
+  CARGO_INCREMENTAL: 0
+  RUSTFLAGS: "-Dwarnings"
+  RUSTDOCFLAGS: "-Dwarnings"
+
+jobs:
+  clippy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@1.74.0
+        with:
+          components: clippy
+      - run: cargo clippy -- -D warnings
+      # TODO: - run: cargo clippy --all-features --all-targets -- -D warnings
+
+  doc:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo doc --workspace --all-features --document-private-items
+
+  rustfmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rustfmt
+      - run: cargo fmt --all -- --check
diff --git a/Cargo.toml b/Cargo.toml
index f35cc86..c6c8220 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,3 +3,6 @@ resolver = "2"
 members = [
     "ml-kem",
 ]
+
+[profile.bench]
+debug = true
diff --git a/ml-kem/Cargo.toml b/ml-kem/Cargo.toml
index 07ea6b7..e973621 100644
--- a/ml-kem/Cargo.toml
+++ b/ml-kem/Cargo.toml
@@ -2,6 +2,7 @@
 name = "ml-kem"
 version = "0.1.0"
 edition = "2021"
+rust-version = "1.74"
 
 [features]
 default = []
@@ -20,9 +21,6 @@ hex = "0.4.3"
 hex-literal = "0.4.1"
 rand = "0.8.5"
 
-[profile.bench]
-debug = true
-
 [[bench]]
 name = "mlkem"
 harness = false
diff --git a/ml-kem/src/kem.rs b/ml-kem/src/kem.rs
index c1ee71c..2c5606f 100644
--- a/ml-kem/src/kem.rs
+++ b/ml-kem/src/kem.rs
@@ -191,7 +191,7 @@ where
         &self,
         m: &B32,
     ) -> Result<(EncodedCiphertext<P>, SharedKey), Self::Error> {
-        Ok(self.encapsulate_deterministic_inner(&m))
+        Ok(self.encapsulate_deterministic_inner(m))
     }
 }
 
diff --git a/ml-kem/src/lib.rs b/ml-kem/src/lib.rs
index 326bc0a..5bd837f 100644
--- a/ml-kem/src/lib.rs
+++ b/ml-kem/src/lib.rs
@@ -102,7 +102,11 @@ pub trait EncapsulateDeterministic<EK, SS> {
     /// Encapsulation error
     type Error: Debug;
 
-    /// Encapsulates a fresh shared secret
+    /// Encapsulates a fresh shared secret.
+    ///
+    /// # Errors
+    ///
+    /// Will vary depending on the underlying implementation.
     fn encapsulate_deterministic(&self, m: &B32) -> Result<(EK, SS), Self::Error>;
 }