diff --git a/.github/workflows/pr-scripts.yml b/.github/workflows/pr-scripts.yml
index 834f7c998..a813412b6 100644
--- a/.github/workflows/pr-scripts.yml
+++ b/.github/workflows/pr-scripts.yml
@@ -9,6 +9,8 @@ on:
       - '.env.release.example'
       - '.env.release.draft'
       - 'compose.release.yml'
+      - 'compose.release.analytics.yml'
+      - 'compose.analytics-umami.yml'
       - 'compose.storage.*.yml'
       - 'deploy/storage/**'
       - 'deploy/runtime-mirror-images.txt'
@@ -55,6 +57,7 @@ jobs:
       - run: python -m unittest discover -s scanner/tests -p 'test_*.py'
       - run: bash scripts/tests/publish-cli-test.sh
       - run: bash scripts/tests/runtime-secret-test.sh
+      - run: bash scripts/tests/runtime-analytics-test.sh
       - run: bash scripts/tests/validate-release-config-test.sh
       - run: bash scripts/tests/storage-compose-test.sh
       - run: bash scripts/tests/storage-compose-render-test.sh
diff --git a/scripts/tests/runtime-analytics-test.sh b/scripts/tests/runtime-analytics-test.sh
new file mode 100644
index 000000000..4b308d76a
--- /dev/null
+++ b/scripts/tests/runtime-analytics-test.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "$0")/../.." && pwd)
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+mkdir -p "$TMP/bin" "$TMP/home"
+cat >"$TMP/bin/docker" <<'SH'
+#!/bin/sh
+printf '%s\n' "$*" >>"$DOCKER_LOG"
+exit 0
+SH
+chmod +x "$TMP/bin/docker"
+export DOCKER_LOG="$TMP/docker.log" SKILLHUB_HOME="$TMP/home" SKILLHUB_RAW_BASE="file://$ROOT" PATH="$TMP/bin:$PATH"
+run() { sh "$ROOT/scripts/runtime.sh" "$@" >"$TMP/output"; }
+fail() { echo "FAIL: $*" >&2; exit 1; }
+run analytics-up
+[ -f "$TMP/home/analytics/compose.analytics-umami.yml" ] || fail 'missing platform file'
+[ "$(stat -f %Lp "$TMP/home/analytics/.env")" = 600 ] || fail 'secret permissions'
+secret_before=$(shasum -a 256 "$TMP/home/analytics/.env" | cut -d' ' -f1)
+run analytics-up
+[ "$(shasum -a 256 "$TMP/home/analytics/.env" | cut -d' ' -f1)" = "$secret_before" ] || fail 'secrets overwritten'
+if run analytics-enable --website-id not-a-uuid; then fail 'accepted invalid UUID'; fi
+if run analytics-enable --website-id 4398de8e-40df-4483-9eea-ed213643525f --upstream 'https://evil.test/path'; then fail 'accepted path'; fi
+run analytics-enable --website-id 4398de8e-40df-4483-9eea-ed213643525f
+grep -q '^SKILLHUB_ANALYTICS_NETWORK_ENABLED=true$' "$TMP/home/.env.release" || fail 'network not persisted'
+grep -q -- '-f .*compose.release.analytics.yml up -d --no-deps --force-recreate web' "$DOCKER_LOG" || fail 'overlay missing'
+run up --no-scanner
+grep -q -- '-f .*compose.release.analytics.yml up -d postgres' "$DOCKER_LOG" || fail 'up lost overlay'
+run analytics-disable
+grep -q '^SKILLHUB_ANALYTICS_NETWORK_ENABLED=false$' "$TMP/home/.env.release" || fail 'network not detached'
+grep -q '^SKILLHUB_WEB_ANALYTICS_CONFIG=$' "$TMP/home/.env.release" || fail 'collection still enabled'
+run analytics-enable --website-id 4398de8e-40df-4483-9eea-ed213643525f --upstream https://stats.example.com
+grep -q '^SKILLHUB_ANALYTICS_NETWORK_ENABLED=false$' "$TMP/home/.env.release" || fail 'external platform joined local network'
+run analytics-down
+grep -q -- 'compose.analytics-umami.yml stop' "$DOCKER_LOG" || fail 'analytics down removed volumes'
+! grep -q -- 'compose.analytics-umami.yml down' "$DOCKER_LOG" || fail 'analytics down removed project'
+echo 'runtime-analytics-test passed'