diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
new file mode 100644
index 0000000..e6a8bd6
--- /dev/null
+++ b/.github/workflows/mutation.yml
@@ -0,0 +1,55 @@
+---
+
+name: Mutation Tests
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+  push:
+    branches: [4.x]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  mutation:
+    name: Infection
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: sockets, msgpack
+          coverage: xdebug
+          # Infection aborts the initial test run on any stderr output, and the msgpack
+          # tests trigger an expected "Extra bytes" warning that log_errors sends there.
+          ini-values: memory_limit=-1, log_errors=Off
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@v3
+        with:
+          dependency-versions: highest
+
+      # The Infection phar is unusable with Testo: its bundled adapter calls the
+      # unscoped \Infection\StreamWrapper\IncludeInterceptor. Infection requires
+      # PHP 8.3+, so it is installed here instead of in require-dev.
+      - name: Install Infection
+        run: |
+          composer config allow-plugins.infection/extension-installer true
+          composer require --dev --no-interaction --no-progress -W infection/infection testo/bridge-infection
+
+      - name: Build test server
+        run: docker build --tag test-server:local -f ./tests/test-server/Dockerfile ./tests/test-server
+
+      - name: Run test server
+        run: docker run --name test-server --rm -d -p "7079:7079/tcp" test-server:local
+
+      - name: Run Infection
+        run: vendor/bin/infection --threads=max --logger-github --show-mutations=0 --min-msi=90 --min-covered-msi=90
+        env:
+          STRYKER_DASHBOARD_API_KEY: ${{ github.event_name == 'push' && secrets.STRYKER_DASHBOARD_API_KEY || '' }}
diff --git a/README.md b/README.md
index 08db642..b627268 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,7 @@
 
 [![Psalm Level](https://shepherd.dev/github/roadrunner-php/goridge/level.svg)](https://shepherd.dev/github/roadrunner-php/goridge)
 [![Type Coverage](https://shepherd.dev/github/roadrunner-php/goridge/coverage.svg)](https://shepherd.dev/github/roadrunner-php/goridge)
+[![Mutation testing badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fbadge-api.stryker-mutator.io%2Fgithub.com%2Froadrunner-php%2Fgoridge%2F4.x)](https://dashboard.stryker-mutator.io/reports/github.com/roadrunner-php/goridge/4.x)
 
 </div>
 
diff --git a/infection.json.dist b/infection.json.dist
index 9e8be0d..93c757d 100644
--- a/infection.json.dist
+++ b/infection.json.dist
@@ -1,11 +1,20 @@
 {
-    "$schema": "vendor/infection/infection/resources/schema.json",
+    "$schema": "https://raw.githubusercontent.com/infection/infection/0.35.6/resources/schema.json",
     "source": {
         "directories": [
             "src"
         ]
     },
     "testFramework": "testo",
+    "tmpDir": "runtime",
+    "timeout": 15,
+    "logs": {
+        "text": "runtime/infection.log",
+        "github": true,
+        "stryker": {
+            "report": "4.x"
+        }
+    },
     "mutators": {
         "@default": true
     }