diff --git a/.github/workflows/pr-url.yml b/.github/workflows/pr-url.yml
index 1d07493f5..e08f51e82 100644
--- a/.github/workflows/pr-url.yml
+++ b/.github/workflows/pr-url.yml
@@ -4,7 +4,8 @@ on:
     types: [opened]
 jobs:
   pr-url:
-    if: github.repository_owner == 'microbit-foundation'
+    # Fork branches aren't deployed to the review site.
+    if: github.repository_owner == 'microbit-foundation' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: microbit-foundation/action-pr-url-template@v0.1.2
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 000000000..2dd83d3c6
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,58 @@
+name: pr
+
+# Checks for pull requests from forks, which build.yml doesn't see as it runs
+# on push. No secrets, theme or deploy: this runs contributor code. The repo
+# requires maintainer approval before it runs for external contributors.
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  # renovate: datasource=npm depName=npm
+  NPM_VERSION: "11"
+
+jobs:
+  build:
+    # Branches in this repo are already checked by build.yml.
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    env:
+      VITE_STAGE: REVIEW
+      VITE_FOUNDATION_BUILD: false
+      FEATURE_PWA: false
+      BASE_URL: /
+      E2E_BASE_URL: /
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Configure node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: 24.x
+          cache: "npm"
+          registry-url: "https://npm.pkg.github.com"
+      - run: npm install -g npm@${{ env.NPM_VERSION }} --registry=https://registry.npmjs.org
+      - run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: npm run ci
+      - name: Run Playwright tests
+        timeout-minutes: 10
+        uses: docker://mcr.microsoft.com/playwright:v1.64.1-noble
+        with:
+          args: npx playwright test
+      - name: Store reports
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 3
diff --git a/netlify.toml b/netlify.toml
deleted file mode 100644
index 79bcd1aa9..000000000
--- a/netlify.toml
+++ /dev/null
@@ -1,9 +0,0 @@
-[Settings]
-[build]
-command = "npm run ci"
-[build.environment]
-  CI = "true"
-[[redirects]]
-  from = "/*"
-  to = "/index.html"
-  status = 200