diff --git a/.github/actions/internal/prisma-generate-verify/action.yml b/.github/actions/internal/prisma-generate-verify/action.yml
new file mode 100644
index 0000000000..f4156b8a17
--- /dev/null
+++ b/.github/actions/internal/prisma-generate-verify/action.yml
@@ -0,0 +1,58 @@
+# Verifies Prisma generate for one package (monoweb or grades) against a job-level PostgreSQL service container and
+# fails if committed generated artifacts are out of date.
+
+name: Verify Prisma generate
+description: Migrate and generate Prisma artifacts for monoweb or grades, then assert generated output matches git.
+inputs:
+  package:
+    description: Which Prisma package to verify; `monoweb` (@dotkomonline/db) or `grades` (@dotkomonline/grades-db)
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Configure Prisma verify environment
+      shell: bash
+      env:
+        PACKAGE: ${{ inputs.package }}
+      run: |
+        case "$PACKAGE" in
+          monoweb)
+            echo "DATABASE_URL=postgresql://ow:owpassword123@localhost:5432/ow" >> "$GITHUB_ENV"
+            echo "PNPM_FILTER=@dotkomonline/db" >> "$GITHUB_ENV"
+            echo "GENERATED_PATH=packages/db/generated" >> "$GITHUB_ENV"
+            ;;
+          grades)
+            echo "DATABASE_URL=postgresql://grades:gradespassword123@localhost:5432/grades" >> "$GITHUB_ENV"
+            echo "PNPM_FILTER=@dotkomonline/grades-db" >> "$GITHUB_ENV"
+            echo "GENERATED_PATH=packages/grades-db/generated" >> "$GITHUB_ENV"
+            ;;
+          *)
+            echo "Unknown package: $PACKAGE (expected monoweb or grades)" >&2
+            exit 1
+            ;;
+        esac
+
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      with:
+        version: 10.28.2
+
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 22.21.1
+        cache: 'pnpm'
+
+    - name: Install dependencies from pnpm lockfile
+      shell: bash
+      run: pnpm install --frozen-lockfile
+
+    - name: Apply database migrations
+      shell: bash
+      run: pnpm -F "$PNPM_FILTER" prisma migrate deploy
+
+    - name: Generate Prisma client and TypedSQL
+      shell: bash
+      run: pnpm -F "$PNPM_FILTER" generate
+
+    - name: Fail if generated Prisma artifacts are out of date
+      shell: bash
+      run: git diff --exit-code "$GENERATED_PATH"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 986bc6f016..a0f45d42dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,6 @@
 # The main integration pipeline
 #
-# It is responsible for verifying linting, type checking, and building packages
-# in the entire monorepo.
+# It is responsible for verifying linting, type checking, testing, and building packages in the entire monorepo.
 
 name: CI & CD
 on:
@@ -14,13 +13,12 @@ on:
       - synchronize
 
 permissions:
-  id-token: write   
+  id-token: write
   contents: read
+
 jobs:
-  # The "check" job is responsible for verifying the minimum requirements to
-  # build all the packages in the monorepo.
-  check:
-    name: Verify build requirements
+  verify-quality-checks:
+    name: Lint, type check, and unit tests
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -43,15 +41,88 @@ jobs:
       - run: pnpm install --frozen-lockfile
         name: Install dependencies from pnpm lockfile
       - run: pnpm lint-check
-        name: Run linting and formatting checks
+        name: Linting and formatting checks
       - run: pnpm type-check
-        name: Run TypeScript type checker
+        name: TypeScript type checker
+      - run: pnpm test
+        name: Unit tests
+
+  test-integration:
+    name: Integration tests
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          version: 10.28.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22.21.1
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+        name: Install dependencies from pnpm lockfile
+      - run: pnpm test:it
+        name: Run RPC integration tests
+
+  verify-monoweb-prisma-generate:
+    name: Verify Prisma generate (Monoweb)
+    runs-on: ubuntu-24.04-arm
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:b7587f3cb74f4f4b2a4f9d67f052edbf95eb93f4fec7c5ada3792546caaf7383
+        env:
+          POSTGRES_USER: ow
+          POSTGRES_PASSWORD: owpassword123
+          POSTGRES_DB: ow
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U ow -d ow"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+      - uses: ./.github/actions/internal/prisma-generate-verify
+        with:
+          package: monoweb
+
+  verify-grades-prisma-generate:
+    name: Verify Prisma generate (Grades)
+    runs-on: ubuntu-24.04-arm
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:b7587f3cb74f4f4b2a4f9d67f052edbf95eb93f4fec7c5ada3792546caaf7383
+        env:
+          POSTGRES_USER: grades
+          POSTGRES_PASSWORD: gradespassword123
+          POSTGRES_DB: grades
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U grades -d grades"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+      - uses: ./.github/actions/internal/prisma-generate-verify
+        with:
+          package: grades
 
   build-dashboard:
     name: dashboard
     runs-on: ubuntu-24.04-arm
     needs:
-      - check
+      - verify-quality-checks
+      - test-integration
+      - verify-monoweb-prisma-generate
     steps:
       - name: Install local GitHub Actions
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -69,7 +140,9 @@ jobs:
     name: rpc
     runs-on: ubuntu-24.04-arm
     needs:
-      - check
+      - verify-quality-checks
+      - test-integration
+      - verify-monoweb-prisma-generate
     steps:
       - name: Install local GitHub Actions
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -87,7 +160,9 @@ jobs:
     name: web
     runs-on: ubuntu-24.04-arm
     needs:
-      - check
+      - verify-quality-checks
+      - test-integration
+      - verify-monoweb-prisma-generate
     steps:
       - name: Install local GitHub Actions
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -105,7 +180,9 @@ jobs:
     name: grades-backend
     runs-on: ubuntu-24.04-arm
     needs:
-      - check
+      - verify-quality-checks
+      - test-integration
+      - verify-grades-prisma-generate
     steps:
       - name: Install local GitHub Actions
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -123,7 +200,9 @@ jobs:
     name: grades-frontend
     runs-on: ubuntu-24.04-arm
     needs:
-      - check
+      - verify-quality-checks
+      - test-integration
+      - verify-grades-prisma-generate
     steps:
       - name: Install local GitHub Actions
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6