diff --git a/.github/workflows/plugin-ai-checklist.yml b/.github/workflows/plugin-ai-checklist.yml
new file mode 100644
index 0000000..49b5f14
--- /dev/null
+++ b/.github/workflows/plugin-ai-checklist.yml
@@ -0,0 +1,20 @@
+name: AI Checklist
+
+on:
+  workflow_call: {}
+
+# The gate reads the pull request description; callers must grant these two
+# scopes in their own permissions block.
+permissions:
+  actions: read
+  pull-requests: read
+
+jobs:
+  AiChecklist:
+    name: AI checklist gate
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Run tests
+        uses: matomo-org/github-action-checklist-gate@d5f101a2538ef30ddb3b06cc366f852c9851b588 # main as of 2026-08-04
diff --git a/.github/workflows/plugin-phpcs.yml b/.github/workflows/plugin-phpcs.yml
new file mode 100644
index 0000000..8c45ad3
--- /dev/null
+++ b/.github/workflows/plugin-phpcs.yml
@@ -0,0 +1,58 @@
+name: PHPCS check
+
+on:
+  workflow_call:
+    inputs:
+      plugin-name:
+        description: "Name of the plugin, e.g. LoginLdap"
+        required: true
+        type: string
+      php-version:
+        description: "PHP version the job runs on"
+        required: false
+        type: string
+        default: '7.4'
+
+# The job only reads the repository; everything else stays at none so any caller
+# with default workflow permissions can use this without granting scopes.
+permissions:
+  contents: read
+
+jobs:
+  phpcs:
+    name: PHPCS
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Validate inputs
+        env:
+          PLUGIN_NAME: ${{ inputs.plugin-name }}
+        run: |
+          if [[ ! "$PLUGIN_NAME" =~ ^[A-Za-z0-9_]+$ ]]; then
+            echo "Invalid plugin-name: $PLUGIN_NAME"
+            exit 1
+          fi
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          lfs: false
+          persist-credentials: false
+      - name: Setup PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: ${{ inputs.php-version }}
+          tools: cs2pr
+      - name: Install dependencies
+        env:
+          PLUGIN_NAME: ${{ inputs.plugin-name }}
+        run:
+          composer init --name="matomo/$(echo "$PLUGIN_NAME" | tr '[:upper:]' '[:lower:]')" --quiet;
+          composer --no-plugins config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true -n;
+          composer config repositories.matomo-coding-standards vcs https://github.com/matomo-org/matomo-coding-standards -n;
+          composer require matomo-org/matomo-coding-standards:dev-master;
+          composer install --dev --prefer-dist --no-progress --no-suggest
+      - name: Check PHP code styles
+        id: phpcs
+        run: ./vendor/bin/phpcs --report-full --standard=phpcs.xml --report-checkstyle=./phpcs-report.xml
+      - name: Show PHPCS results in PR
+        if: ${{ always() && steps.phpcs.outcome == 'failure' }}
+        run: cs2pr ./phpcs-report.xml --prepend-filename
diff --git a/README.md b/README.md
index ff23811..879b08a 100644
--- a/README.md
+++ b/README.md
@@ -181,6 +181,49 @@ scripts. For immutability, pin the `uses:` reference to a full commit SHA — re
 mutable unless the repository enforces immutable releases — and pass the same SHA as
 `scripts-ref`, which the workflow uses to check out its helper scripts (default: `main`).
 
+### PHPCS (`.github/workflows/plugin-phpcs.yml`)
+
+Runs the plugin's own `phpcs.xml` against the matomo-coding-standards ruleset. Inputs:
+`plugin-name` (required), `php-version` (optional, default `7.4`).
+
+```yaml
+name: PHPCS check
+on: pull_request
+jobs:
+  phpcs:
+    uses: matomo-org/github-action-tests/.github/workflows/plugin-phpcs.yml@main
+    with:
+      plugin-name: MyPlugin
+```
+
+### AI Checklist (`.github/workflows/plugin-ai-checklist.yml`)
+
+Runs the org's checklist gate against the pull request description. No inputs.
+
+```yaml
+name: AI Checklist
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+permissions:
+  actions: read
+  pull-requests: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  AiChecklist:
+    uses: matomo-org/github-action-tests/.github/workflows/plugin-ai-checklist.yml@main
+```
+
+Both examples use `@main` to match how plugin repositories currently consume this repository.
+For immutability, pin the `uses:` reference to a full commit SHA — release tags stay mutable
+unless the repository enforces immutable releases:
+
+```yaml
+    uses: matomo-org/github-action-tests/.github/workflows/plugin-phpcs.yml@<full commit SHA>
+```
+
 ## Git hooks (`hooks/`)
 
 `hooks/pre-push` is the canonical copy of the PHPStan pre-push hook that plugin repositories