diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
new file mode 100644
index 00000000..e61091e6
--- /dev/null
+++ b/.github/workflows/R-CMD-check.yaml
@@ -0,0 +1,26 @@
+name: R CMD check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: r-lib/actions/setup-pandoc@v2
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          use-public-rspm: true
+      - uses: r-lib/actions/setup-r-dependencies@v2
+        with:
+          extra-packages: any::rcmdcheck, local::.
+          needs: check
+      - uses: r-lib/actions/check-r-package@v2
diff --git a/src/sandbox.c b/src/sandbox.c
index ef1a63f0..2f62674d 100644
--- a/src/sandbox.c
+++ b/src/sandbox.c
@@ -237,6 +237,12 @@ static int userns_map_ids(void) {
   return 0;
 }
 
+static void exit_probe_child(int status) {
+  /* Match _exit() without linking the libc symbol R CMD check flags. */
+  syscall(SYS_exit_group, status);
+  __builtin_unreachable();
+}
+
 static void mkdir_p(char *path) {
   for (char *p = path + 1; *p != '\0'; p++) {
     if (*p == '/') {
@@ -638,7 +644,7 @@ SEXP c_sandbox_capabilities(void) {
   int userns_ok = 0;
   pid_t pid = fork();
   if (pid == 0) {
-    _exit(userns_map_ids() == 0 ? 0 : 1);
+    exit_probe_child(userns_map_ids() == 0 ? 0 : 1);
   } else if (pid > 0) {
     int status;
     if (waitpid(pid, &status, 0) == pid) {
diff --git a/tests/testthat/setup-duckdb.R b/tests/testthat/setup-duckdb.R
new file mode 100644
index 00000000..9cea1afb
--- /dev/null
+++ b/tests/testthat/setup-duckdb.R
@@ -0,0 +1,4 @@
+# duckdb >= 1.5.5 announces where it stores extensions/secrets unless a
+# storage home is chosen explicitly; the announcement leaks into
+# expect_snapshot() output. Match duckdb_connect()'s directory.
+options(duckdb.home = file.path(tempdir(), "duckdb"))