diff --git a/.gitea/workflows/molecule.yaml b/.gitea/workflows/molecule.yaml
new file mode 100644
index 0000000..15e6832
--- /dev/null
+++ b/.gitea/workflows/molecule.yaml
@@ -0,0 +1,30 @@
+name: Molecule
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+
+permissions:
+  contents: read
+
+jobs:
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    steps:
+    # The scenario includes the role by its name, so the directory must be named like the role and not like the
+    # repository. Its parent is used as roles path.
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      with:
+        path: certificate_authority
+    - name: Install molecule
+      run: |
+        apt update --yes
+        apt install --yes python3-pip
+        pip3 install --break-system-packages molecule
+    - name: Run molecule
+      run: molecule test
+      working-directory: certificate_authority
diff --git a/README.md b/README.md
index 6ff9fad..9460f33 100644
--- a/README.md
+++ b/README.md
@@ -25,12 +25,11 @@ container per supported distribution family, applies the role, asserts that a se
 verifies the issued certificates with `openssl verify`, their file permissions and the anchor in the systems trust
 store.
 
-Molecule ships only its `default` driver, therefore `podman` and the collection `containers.podman` are required
-besides molecule itself.
+Molecule ships only its `default` driver, therefore `podman` is required besides molecule itself. The collections are
+declared in `molecule/default/collections.yml` and installed by molecule.
 
 ```bash
 pip install molecule
-ansible-galaxy collection install community.crypto containers.podman
 ```
 
 The complete sequence creates the containers, tests them and removes them afterwards.
diff --git a/molecule/default/collections.yml b/molecule/default/collections.yml
new file mode 100644
index 0000000..74ba4b1
--- /dev/null
+++ b/molecule/default/collections.yml
@@ -0,0 +1,5 @@
+---
+
+collections:
+- name: community.crypto
+- name: containers.podman