diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..7886ce0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test -race -coverprofile=coverage.out ./...
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+
+      - name: golangci-lint
+        run: golangci-lint run ./...
+
+  vulncheck:
+    name: Vulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..fa1dc93
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,17 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/),
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Added
+
+- GitHub Actions CI with test, lint (golangci-lint), and vulncheck jobs
+
+### Changed
+
+- Bumped Go from 1.25.0 to 1.25.3 to fix stdlib vulnerabilities
+- Use published go-didcomm v0.1.0 instead of local replace directive
diff --git a/CLAUDE.md b/CLAUDE.md
index 666694e..54bc5f7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -83,7 +83,7 @@ Each message file follows the same pattern:
 
 ### Dependencies
 
-- `github.com/Notabene-id/go-didcomm` — DIDComm v2 (`Message`, `Client`, resolvers). Uses local replace directive.
+- `github.com/Notabene-id/go-didcomm` — DIDComm v2 (`Message`, `Client`, resolvers)
 - `github.com/google/uuid` — message ID generation
 
 ### Test vectors
@@ -101,3 +101,9 @@ The `Agent.For` field uses `ForField` type, which handles JSON marshaling of bot
 - All body structs must have `Context` (`@context`) and `Type` (`@type`) fields, set automatically by constructors
 - Thread-based messages (replies) take a `thid` parameter; initiating messages do not
 - Test files include: JSON round-trip, constructor validation (required fields), `ParseBody` dispatch, and test vector loading where available
+
+## Documentation requirements
+
+- **CHANGELOG.md** — Maintain a `CHANGELOG.md` in the project root using [Keep a Changelog](https://keepachangelog.com/) format. Update it with every user-facing change (new features, bug fixes, breaking changes, dependency updates). Group entries under `Added`, `Changed`, `Fixed`, `Removed` sections within version headings.
+- **README.md** — Update `README.md` whenever changes affect public API, usage examples, installation instructions, or project capabilities.
+- **CLAUDE.md** — Update this file whenever changes affect architecture, file layout, commands, dependencies, or development guidelines (e.g., new message types added to the file layout table, new commands, changed patterns).
diff --git a/client_test.go b/client_test.go
index ccfeffa..1023acc 100644
--- a/client_test.go
+++ b/client_test.go
@@ -1,6 +1,7 @@
 package tap
 
 import (
+	"context"
 	"encoding/json"
 	"testing"
 
@@ -46,7 +47,7 @@ func TestClient_ReceivePlainMessage(t *testing.T) {
 	dc := didcomm.NewClient(nil, nil)
 	client := NewClient(dc)
 
-	result, err := client.Receive(nil, envelope)
+	result, err := client.Receive(context.TODO(), envelope)
 	if err != nil {
 		t.Fatalf("Receive: %v", err)
 	}
diff --git a/go.mod b/go.mod
index 208d01c..94b0f68 100644
--- a/go.mod
+++ b/go.mod
@@ -1,9 +1,9 @@
 module github.com/TransactionAuthorizationProtocol/tap-go
 
-go 1.25.0
+go 1.26.0
 
 require (
-	github.com/Notabene-id/go-didcomm v0.0.0
+	github.com/Notabene-id/go-didcomm v0.1.0
 	github.com/google/uuid v1.6.0
 )
 
@@ -24,5 +24,3 @@ require (
 	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/sys v0.39.0 // indirect
 )
-
-replace github.com/Notabene-id/go-didcomm => ../go-didcomm
diff --git a/go.sum b/go.sum
index 535e74e..504d17c 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/Notabene-id/go-didcomm v0.1.0 h1:qouUDL3vXiJRu8c2pIfk2cZre7NtO9WN4TqAbqCqVnM=
+github.com/Notabene-id/go-didcomm v0.1.0/go.mod h1:wIm3s9UCKYYLe2zIysHjTKj7SCU9g25HUWWWc8h9mho=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=