diff --git a/.github/cnti/cnti-testsuite.yaml b/.github/cnti/cnti-testsuite.yaml
new file mode 100644
index 000000000..559355a85
--- /dev/null
+++ b/.github/cnti/cnti-testsuite.yaml
@@ -0,0 +1,20 @@
+# CNTi Test Suite configuration for the CoreDNS chart, used by
+# .github/workflows/cnti.yml. The chart is installed with its defaults.
+config_version: "v2"
+common:
+  container_names:
+    # Released CoreDNS tags the rolling update, downgrade and rollback tests
+    # move the image to. None of them may be the chart's appVersion: setting
+    # the installed tag rolls out nothing. When appVersion changes, earlier
+    # releases are the natural choice.
+    - name: coredns
+      rolling_update_test_tag: "1.14.4"
+      rolling_downgrade_test_tag: "1.13.2"
+      rolling_version_change_test_tag: "1.14.4"
+      rollback_from_tag: "1.14.4"
+deployments:
+  helm_dirs:
+    - name: coredns
+      # Relative to this file.
+      helm_directory: ../../charts/coredns
+      namespace: coredns-cnti
diff --git a/.github/workflows/cnti.yml b/.github/workflows/cnti.yml
new file mode 100644
index 000000000..fa1f91021
--- /dev/null
+++ b/.github/workflows/cnti.yml
@@ -0,0 +1,64 @@
+# Installs the chart on a kind cluster, runs the CNTi Test Suite's essential tests
+# against it and publishes the result as the badge in the README.
+# https://github.com/lfn-cnti/testsuite-action
+name: CNTi essential
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+  # Pull requests that change the job or its configuration.
+  pull_request:
+    paths:
+      - .github/workflows/cnti.yml
+      - .github/cnti/**
+
+permissions:
+  contents: read
+
+# One run per branch or pull request at a time; a new commit on a pull
+# request cancels the run for the previous one.
+concurrency:
+  group: cnti-essential-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  # Runs on master (nightly or by hand): the only runs that publish the badge,
+  # and the only ones with a write token. Forks that enable scheduled workflows
+  # do not run either job.
+  essential:
+    if: github.repository == 'coredns/helm' && github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      # Publishes the badge to the orphan branch `badges`.
+      contents: write
+    steps: &essential-steps
+      - uses: actions/checkout@v7
+        with:
+          # The suite doesn't need the job's write token; the action passes it
+          # to the badge publisher on its own.
+          persist-credentials: false
+
+      # Creates a kind cluster of a control plane and two workers, installs
+      # the chart with its defaults, and runs the essential tests.
+      - uses: lfn-cnti/testsuite-action@v1.2.0
+        with:
+          # A released suite version, bumped on purpose after reading the
+          # release notes.
+          version: v2.2.0
+          cnf_config: .github/cnti/cnti-testsuite.yaml
+          tests: cert
+          badge_branch: badges
+
+  # Pull requests that change the job or its configuration, and manual runs
+  # on other branches: the same steps with a read-only token. The action
+  # publishes the badge only from the default branch, so nothing is
+  # published here.
+  essential-pr:
+    if: github.repository == 'coredns/helm' && (github.event_name == 'pull_request' || github.ref != 'refs/heads/master')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps: *essential-steps
diff --git a/charts/coredns/Chart.yaml b/charts/coredns/Chart.yaml
index a7a35f249..6bea45344 100644
--- a/charts/coredns/Chart.yaml
+++ b/charts/coredns/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: coredns
-version: 1.48.2
+version: 1.48.3
 appVersion: 1.14.7
 home: https://coredns.io
 icon: https://coredns.io/images/CoreDNS_Colour_Horizontal.png
@@ -20,4 +20,4 @@ type: application
 annotations:
   artifacthub.io/changes: |
     - kind: added
-      description: Add optional replica count and PodDisruptionBudget for the cluster-proportional-autoscaler
+      description: CNTi cert badge in the README, from a nightly CNTi Test Suite run of the chart's defaults
diff --git a/charts/coredns/README.md b/charts/coredns/README.md
index d9cfeb87d..f0321e158 100644
--- a/charts/coredns/README.md
+++ b/charts/coredns/README.md
@@ -1,5 +1,7 @@
 # CoreDNS
 
+[![CNTi essential](https://github.com/coredns/helm/raw/badges/cnti-badge.svg)](https://github.com/coredns/helm/actions/workflows/cnti.yml)
+
 [CoreDNS](https://coredns.io/) is a DNS server that chains plugins and provides DNS Services
 
 # TL;DR;