diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8e446d3..863ed17 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,20 +1,33 @@
 name: PlatformIO CI
-on: [push]
+
+on: [push, pull_request]
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
       - uses: actions/cache@v4
         with:
           path: |
             ~/.cache/pip
             ~/.platformio/.cache
           key: ${{ runner.os }}-pio
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
+
       - name: Install PlatformIO Core
         run: pip install --upgrade platformio
+
+      # secrets.h is git-ignored on purpose (contains real WiFi credentials).
+      # For CI, we generate a throwaway secrets.h from the example file so
+      # the build compiles without ever needing real credentials or storing
+      # any secret files in the repo.
+      - name: Generate placeholder secrets.h for CI build
+        run: cp include/secrets.h.example include/secrets.h
+
       - name: Build PlatformIO Project
         run: pio run
diff --git a/include/secrets.h b/include/secrets.h
deleted file mode 100644
index 775d156..0000000
--- a/include/secrets.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#pragma once
-
-// Copy this file to secrets.h and fill in your real values.
-// secrets.h is git-ignored and must never be committed.
-
-#define WIFI_SSID "YOUR_WIFI_SSID"
-#define WIFI_PASSWORD "YOUR_WIFI_PASSWORD"
-
-#define WEATHER_API_URL "http://<host>:<port>/api/weather"
-#define CALENDAR_API_URL "http://<host>:<port>/api/events"
-#define DEPARTURES_API_URL "http://<host>:<port>/api/departures"