diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a8df8bc65..9615e56c2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -49,3 +49,63 @@ jobs:
           fi
       - name: osv-scanner
         run: osv-scanner scan source -r .
+
+  # DB-backed Go tests need Postgres 16 with a pre-migrated template database.
+  # The image is built from testing/dbtest/docker (not HashiCorp's Docker Hub
+  # image) and published on 127.0.0.1:55432 because the tests hardcode loopback.
+  # Skipped on pull requests to spare the shared runner pool.
+  db-tests:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      TEST_DB_PORT: "55432"
+      PG_CONTAINER: threshold-sql-tests-${{ github.run_id }}
+    steps:
+      - name: require docker
+        run: |
+          if ! docker info >/dev/null 2>&1; then
+            echo "::error::this runner has no usable docker; db-tests need it"; exit 1
+          fi
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+          cache: false
+      - name: start postgres (pre-migrated template)
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build -q -t threshold-test-pg:16 -f testing/dbtest/docker/Dockerfile.16-alpine testing/dbtest/docker
+          mkdir -p "$RUNNER_TEMP/benchmark_dumps"
+          docker run -d --name "$PG_CONTAINER" -p "$TEST_DB_PORT:5432" \
+            -e POSTGRES_PASSWORD=boundary -e POSTGRES_USER=boundary -e POSTGRES_DB=boundary \
+            -e PGDATA=/pgdata --mount type=tmpfs,destination=/pgdata \
+            -v "$PWD/internal/db/schema/migrations:/migrations" \
+            -v "$RUNNER_TEMP/benchmark_dumps:/benchmark_dumps" \
+            threshold-test-pg:16 -c config_file=/etc/postgresql/postgresql.conf
+          # init scripts run on a temporary server first; wait for the real one
+          for i in $(seq 1 120); do
+            if docker logs "$PG_CONTAINER" 2>&1 | grep -q "init process complete" \
+               && docker exec "$PG_CONTAINER" pg_isready -U boundary -d boundary >/dev/null 2>&1; then
+              echo "postgres ready"; exit 0
+            fi
+            sleep 3
+          done
+          docker logs "$PG_CONTAINER" | tail -30; echo "::error::postgres did not become ready"; exit 1
+      - name: go test (root module, DB-backed)
+        shell: bash
+        run: |
+          # Excluded: tests that start their own dev-DB/Vault containers via
+          # dockertest and then dial the mapped host port, which is unreachable
+          # from inside this job's container (internal/cmd/commands/server also
+          # fails the same way on untouched upstream).
+          pkgs=$(go list ./... | grep -v -E '/testing/internal/e2e|/enos/|/internal/tests/(cli|api)|/internal/cmd/commands/server$|/internal/credential/vault$|/internal/daemon/controller$|/internal/daemon/controller/handlers/credentialstores$')
+          # *Estimated*Count / ListDeletedStoreIds depend on pg planner stats and
+          # also fail on untouched upstream Boundary (verified); skipped here.
+          go test $pkgs -count=1 -p 2 -timeout 90m \
+            -skip 'EstimatedCount|EstimatedCredentialCount|EstimatedLibraryCount|ListDeletedStoreIds'
+      - name: stop postgres
+        if: always()
+        run: docker rm -f -v "$PG_CONTAINER" || true
+