diff --git a/.github/workflows/el7.yml b/.github/workflows/el7.yml
new file mode 100644
index 0000000..168fea0
--- /dev/null
+++ b/.github/workflows/el7.yml
@@ -0,0 +1,184 @@
+name: Enterprise Linux 7 CI/CD
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+  workflow_dispatch:
+
+jobs:
+  build-and-package-el7:
+    name: Build and package on Enterprise Linux 7 (${{ matrix.arch }})
+    # Run on the Ubuntu host so that actions/checkout (Node 20) works; all
+    # CentOS 7 work is done via explicit `docker run centos:7` invocations
+    # below.  Using `container:` at job level would inject Node 20 into the
+    # CentOS 7 container, which may fail due to glibc version differences.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        arch: [x86_64, i686]
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Write shared CentOS 7 vault repo helper
+        run: |
+          # CentOS 7 reached EOL; vault.centos.org holds the final 7.9.2009
+          # release.  The x86_64 vault repos are correct for both arches:
+          # CentOS 7's multilib ships i686 packages in the same repositories.
+          # Use printf to avoid a nested heredoc that would break YAML parsing.
+          cat > "$RUNNER_TEMP/setup-el7-repos.sh" << 'SETUP'
+          setup_centos7_vault_repos() {
+              printf '%s\n' \
+                  '[base]' \
+                  'name=CentOS-7 - Base' \
+                  'baseurl=https://vault.centos.org/7.9.2009/os/x86_64/' \
+                  'gpgcheck=1' \
+                  'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7' \
+                  '' \
+                  '[updates]' \
+                  'name=CentOS-7 - Updates' \
+                  'baseurl=https://vault.centos.org/7.9.2009/updates/x86_64/' \
+                  'gpgcheck=1' \
+                  'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7' \
+                  '' \
+                  '[extras]' \
+                  'name=CentOS-7 - Extras' \
+                  'baseurl=https://vault.centos.org/7.9.2009/extras/x86_64/' \
+                  'gpgcheck=1' \
+                  'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7' \
+                  > /etc/yum.repos.d/CentOS-Base.repo
+          }
+          SETUP
+
+      - name: Build and test inside CentOS 7 container
+        run: |
+          cat > "$RUNNER_TEMP/build-el7.sh" << 'SCRIPT'
+          set -ex
+          # shellcheck source=/dev/null
+          . /setup-el7-repos.sh
+          setup_centos7_vault_repos
+
+          # Install base build dependencies
+          yum install -y \
+              gcc make autoconf automake libtool pkgconfig perl \
+              libX11-devel libXtst-devel texinfo rpm-build git
+
+          # 32-bit (i686) extras and compiler wrapper
+          if [ "$TARGET_ARCH" = "i686" ]; then
+              # libgcc.i686 provides /lib/libgcc_s.so.1 needed by gcc -m32
+              yum install -y \
+                  libgcc.i686 glibc-devel.i686 \
+                  libX11-devel.i686 libXtst-devel.i686
+              # Provide i686-redhat-linux-gnu-gcc so --host= works with autoconf
+              printf '#!/bin/sh\nexec gcc -m32 "$@"\n' \
+                  > /usr/local/bin/i686-redhat-linux-gnu-gcc
+              chmod +x /usr/local/bin/i686-redhat-linux-gnu-gcc
+              ln -sf /usr/local/bin/i686-redhat-linux-gnu-gcc \
+                     /usr/local/bin/i686-redhat-linux-gnu-g++
+              # CFLAGS/LDFLAGS are for this build+test step only.
+              # The RPM step drives -m32 via the rpmbuild --define "optflags ..."
+              # so these are intentionally not set there.
+              export CFLAGS="-m32 -march=i686 -mtune=generic"
+              export LDFLAGS="-m32"
+              CONFIGURE_HOST="--host=i686-redhat-linux-gnu --build=x86_64-redhat-linux-gnu"
+          else
+              CONFIGURE_HOST=""
+          fi
+
+          cd /workspace
+          make -f Makefile.cvs generate
+          # word-split of $CONFIGURE_HOST is intentional (empty or two flags)
+          # shellcheck disable=SC2086
+          ./configure --disable-gui --disable-doc --disable-xinput2 \
+              $CONFIGURE_HOST
+          make
+          make -C cnee/src man
+          chmod +x tests/e2e_cnee.sh
+          ./tests/e2e_cnee.sh ./cnee/src/cnee
+          SCRIPT
+          docker run --rm \
+            -e TARGET_ARCH="${{ matrix.arch }}" \
+            -v "$PWD:/workspace" \
+            -v "$RUNNER_TEMP/build-el7.sh:/build.sh:ro" \
+            -v "$RUNNER_TEMP/setup-el7-repos.sh:/setup-el7-repos.sh:ro" \
+            centos:7 bash /build.sh
+
+      - name: Create source distribution
+        run: |
+          XNEE_VERSION=$(grep 'AC_INIT' configure.in \
+            | awk 'BEGIN {FS=","} { print $2 }' \
+            | tr -d ' ')
+          # git safe.directory was added in git 2.35.2; ignore errors on older git.
+          git config --global --add safe.directory "$(pwd)" 2>/dev/null || true
+          git archive --prefix="xnee-${XNEE_VERSION}/" HEAD \
+            | gzip > "xnee-${XNEE_VERSION}.tar.gz"
+
+      - name: Build RPM inside CentOS 7 container
+        run: |
+          cat > "$RUNNER_TEMP/rpm-el7.sh" << 'SCRIPT'
+          set -ex
+          # shellcheck source=/dev/null
+          . /setup-el7-repos.sh
+          setup_centos7_vault_repos
+
+          yum install -y \
+              gcc make autoconf automake libtool pkgconfig perl \
+              libX11-devel libXtst-devel texinfo rpm-build
+
+          if [ "$TARGET_ARCH" = "i686" ]; then
+              yum install -y \
+                  libgcc.i686 glibc-devel.i686 \
+                  libX11-devel.i686 libXtst-devel.i686
+              printf '#!/bin/sh\nexec gcc -m32 "$@"\n' \
+                  > /usr/local/bin/i686-redhat-linux-gnu-gcc
+              chmod +x /usr/local/bin/i686-redhat-linux-gnu-gcc
+              ln -sf /usr/local/bin/i686-redhat-linux-gnu-gcc \
+                     /usr/local/bin/i686-redhat-linux-gnu-g++
+          fi
+
+          cd /workspace
+          XNEE_VERSION=$(grep 'AC_INIT' configure.in \
+              | awk 'BEGIN {FS=","} { print $2 }' | tr -d ' ')
+          XNEE_RELEASE=1
+          mkdir -p "$HOME/rpmbuild"/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
+          cp "xnee-${XNEE_VERSION}.tar.gz" "$HOME/rpmbuild/SOURCES/"
+          sed \
+              -e "s/XNEE_VERSION/${XNEE_VERSION}/g" \
+              -e "s/XNEE_RELEASE/${XNEE_RELEASE}/g" \
+              build/SPECS/cnee-el7.spec \
+              > "$HOME/rpmbuild/SPECS/cnee.spec"
+
+          if [ "$TARGET_ARCH" = "i686" ]; then
+              # Set host to i686 so %configure uses our wrapper gcc.
+              # Do not export CFLAGS/LDFLAGS here to avoid polluting %configure.
+              rpmbuild -ba \
+                  --define "_host i686-redhat-linux-gnu" \
+                  --define "_host_alias i686-redhat-linux-gnu" \
+                  --define "_target_cpu i686" \
+                  --define "optflags -O2 -g -m32 -march=i686 -mtune=generic" \
+                  "$HOME/rpmbuild/SPECS/cnee.spec"
+          else
+              rpmbuild -ba "$HOME/rpmbuild/SPECS/cnee.spec"
+          fi
+
+          find "$HOME/rpmbuild/RPMS" "$HOME/rpmbuild/SRPMS" -name "*.rpm" \
+              -exec cp {} /workspace/ \;
+          SCRIPT
+          docker run --rm \
+            -e TARGET_ARCH="${{ matrix.arch }}" \
+            -v "$PWD:/workspace" \
+            -v "$RUNNER_TEMP/rpm-el7.sh:/rpm.sh:ro" \
+            -v "$RUNNER_TEMP/setup-el7-repos.sh:/setup-el7-repos.sh:ro" \
+            centos:7 bash /rpm.sh
+
+      - name: Upload RPM artifact
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+        with:
+          name: cnee-el7-${{ matrix.arch }}-rpm
+          path: "*.rpm"
+          if-no-files-found: error
diff --git a/build/SPECS/cnee-el7.spec b/build/SPECS/cnee-el7.spec
new file mode 100644
index 0000000..cfe883b
--- /dev/null
+++ b/build/SPECS/cnee-el7.spec
@@ -0,0 +1,64 @@
+%define packname        xnee
+%define cliname         cnee
+
+Name:           %{cliname}
+Version:        XNEE_VERSION
+Release:        XNEE_RELEASE%{?dist}
+Summary:        X11 event recorder, replayer and distributor (command line tool)
+
+License:        GPLv3+
+URL:            https://www.gnu.org/software/xnee
+Source0:        https://ftp.gnu.org/pub/gnu/xnee/%{packname}-%{version}.tar.gz
+
+BuildRequires:  gcc
+BuildRequires:  make
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  libtool
+BuildRequires:  pkgconfig
+BuildRequires:  libX11-devel%{?_isa}
+BuildRequires:  libXtst-devel%{?_isa}
+BuildRequires:  texinfo
+BuildRequires:  perl
+
+Requires:       libX11%{?_isa}
+Requires:       libXtst%{?_isa}
+
+%description
+GNU Xnee is a suite of programs that can record, replay and distribute
+user actions under the X11 environment. Think of it as a macro recorder
+for X11.
+
+This package contains the command line tool cnee, which allows scripting
+and automation of X11 input event recording and replaying.
+
+%prep
+%setup -q -n %{packname}-%{version}
+
+%build
+make -f Makefile.cvs generate
+%configure \
+    --disable-gui \
+    --disable-doc \
+    --disable-xinput2
+make %{?_smp_mflags}
+make -C cnee/src man
+
+%install
+make install DESTDIR=%{buildroot}
+
+mkdir -p %{buildroot}%{_datadir}/xnee/projects
+install -m 644 projects/*.xnp %{buildroot}%{_datadir}/xnee/projects/
+
+%files
+%doc COPYING AUTHORS ChangeLog INSTALL NEWS README TODO EXAMPLES FAQ BUGS
+%{_bindir}/cnee
+%{_mandir}/man1/cnee.1*
+%{_mandir}/man1/xnee.1*
+%{_datadir}/xnee/
+%{_datadir}/pixmaps/xnee.xpm
+%{_datadir}/pixmaps/xnee.png
+%exclude %{_libdir}/libtestcb.*
+
+%changelog
+# end of file