diff --git a/.github/workflows/selfhost-script.yml b/.github/workflows/selfhost-script.yml
new file mode 100644
index 00000000..042ec14f
--- /dev/null
+++ b/.github/workflows/selfhost-script.yml
@@ -0,0 +1,36 @@
+# Validates the self-hosted setup script: runs with --cpu and --garage,
+# brings up services, runs health checks, then tears down.
+name: Selfhost script (CPU + Garage)
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - main
+  pull_request: {}
+
+jobs:
+  selfhost-cpu-garage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    concurrency:
+      group: selfhost-${{ github.ref }}
+      cancel-in-progress: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run setup-selfhosted.sh (CPU + Garage)
+        run: |
+          ./scripts/setup-selfhosted.sh --cpu --garage
+
+      - name: Quick health checks
+        run: |
+          curl -sf http://localhost:1250/health && echo " Server OK"
+          curl -sf http://localhost:3000 > /dev/null && echo " Frontend OK"
+          curl -sf http://localhost:3903/metrics > /dev/null && echo " Garage admin OK"
+
+      - name: Teardown
+        if: always()
+        run: |
+          docker compose -f docker-compose.selfhosted.yml --profile cpu --profile garage down -v --remove-orphans 2>/dev/null || true
diff --git a/scripts/setup-selfhosted.sh b/scripts/setup-selfhosted.sh
index 6eee6a38..e925c39c 100755
--- a/scripts/setup-selfhosted.sh
+++ b/scripts/setup-selfhosted.sh
@@ -446,7 +446,9 @@ step_server_env() {
         warn "HF_TOKEN not set. Diarization will use a public model fallback."
         warn "For best results, get a token at https://huggingface.co/settings/tokens"
         warn "and accept pyannote licenses at https://huggingface.co/pyannote/speaker-diarization-3.1"
-        read -rp "  HuggingFace token (or press Enter to skip): " current_hf_token
+        if [[ -t 0 ]]; then
+            read -rp "  HuggingFace token (or press Enter to skip): " current_hf_token
+        fi
     fi
     if [[ -n "$current_hf_token" ]]; then
         touch "$root_env"