diff --git a/.github/workflows/build-bwsh.yml b/.github/workflows/build-bwsh.yml
index 41bd161..cdc6f44 100644
--- a/.github/workflows/build-bwsh.yml
+++ b/.github/workflows/build-bwsh.yml
@@ -6,11 +6,13 @@ on:
   push:
     paths:
       - "POC/bwsh/**"
+      - "POC/bwsh.Test/**"
       - ".github/workflows/build-bwsh.yml"
   pull_request:
     types: [opened, synchronize]
     paths:
       - "POC/bwsh/**"
+      - "POC/bwsh.Test/**"
       - ".github/workflows/build-bwsh.yml"
   workflow_dispatch: {}
 
@@ -21,8 +23,35 @@ concurrency:
 permissions: {}
 
 jobs:
+  test:
+    name: Lint and test
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Check formatting
+        run: |
+          dotnet format POC/bwsh/Bwsh.csproj --verify-no-changes
+          dotnet format POC/bwsh.Test/Bwsh.Test.csproj --verify-no-changes
+
+      - name: Run unit tests
+        working-directory: POC/bwsh.Test
+        run: dotnet test --configuration Release
+
   build:
     name: Build (${{ matrix.rid }})
+    needs: test
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 15
     permissions:
diff --git a/POC/bwsh/Commands/Cli.cs b/POC/bwsh/Commands/Cli.cs
index f3af8f2..3e19735 100644
--- a/POC/bwsh/Commands/Cli.cs
+++ b/POC/bwsh/Commands/Cli.cs
@@ -1,6 +1,5 @@
 using System.CommandLine;
 using Bit.SelfHost.Deployments;
-using Bit.SelfHost.Engine;
 using Spectre.Console;
 
 namespace Bit.SelfHost.Commands;
diff --git a/POC/bwsh/Engine/ComposeCli.cs b/POC/bwsh/Engine/ComposeCli.cs
index 8fa8bfd..09ab6a8 100644
--- a/POC/bwsh/Engine/ComposeCli.cs
+++ b/POC/bwsh/Engine/ComposeCli.cs
@@ -1,4 +1,4 @@
-using System.Diagnostics;
+using System.Diagnostics;
 
 namespace Bit.SelfHost.Engine;
 
diff --git a/POC/bwsh/README.md b/POC/bwsh/README.md
index b12706d..1810432 100644
--- a/POC/bwsh/README.md
+++ b/POC/bwsh/README.md
@@ -1,8 +1,9 @@
 # bwsh — Bitwarden self-host CLI
 
 A single .NET tool that installs and manages a Bitwarden self-host deployment — replacing the
-`bitwarden.sh` + `run.sh` + Setup-container stack. It generates all config in-process and drives
-Docker directly. Supports both **standard** and **lite** deployments.
+`bitwarden.sh` + `run.sh` + Setup-container stack. It generates config in-process and brings the
+stack up: **standard** drives the Docker Engine API directly, while **lite** runs the repo's
+`bitwarden-lite/docker-compose.yml` via `docker compose`.
 
 ![bwsh status](docs/images/status.gif)
 
@@ -11,7 +12,7 @@ Docker directly. Supports both **standard** and **lite** deployments.
 ## Prerequisites
 
 - **.NET 10 SDK** — https://dotnet.microsoft.com/download
-- **Docker** running
+- **Docker** running (lite deployments also need the `docker compose` CLI plugin)
 - An installation **ID + key** from https://bitwarden.com/host
 
 ## Install
@@ -104,7 +105,8 @@ ssl:
 `install`/`apply` then provisions the cert with certbot. Renew with `dotnet run -- renewcert` (cron it for
 auto-renewal).
 
-Ports default to 80/443; override with `http-port`/`https-port` in the manifest. Opt out of HTTPS with
+Ports default to 80/443. On standard, override with `http-port`/`https-port` in the manifest; lite
+serves on 80/443 from the upstream compose and ignores those fields. Opt out of HTTPS with
 `ssl: { enable: false }`.
 
 ## Shell completion