diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d27a103..8a771b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,3 +17,15 @@ jobs:
       - run: npm run build
       - run: npm run typecheck
       - run: npm test
+
+  # infra/ ships inside the npm package (dist/templates/infra/), so the HCL is a
+  # released artifact like the JS. fmt/validate need no AWS credentials and make
+  # no AWS calls (provider download only) — plan/apply stay local-only.
+  terraform-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v4
+      - run: terraform -chdir=infra fmt -check -diff
+      - run: terraform -chdir=infra init -backend=false
+      - run: terraform -chdir=infra validate
diff --git a/CLAUDE.md b/CLAUDE.md
index 1360522..8522513 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -9,7 +9,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `npm run typecheck` — `tsgo --noEmit` (type-check only; tsgo can't emit, so `build` stays on `tsc`).
 - `npm test` · `npx vitest run test/x.test.ts` · `npx vitest run -t "name"` — tests (AWS mocked).
 - `npm run dev` — run the CLI from source without building.
-- CI runs build→typecheck→test with **no AWS creds and no Terraform**; keep it that way.
+- CI runs build→typecheck→test plus `terraform fmt -check`/`validate` on `infra/`, with **no AWS creds and no `plan`/`apply`**; keep it that way (`validate` only downloads the provider — it never touches live AWS).
 
 ## Architecture
 - **Two hosting modes, one code path.** Upload (file/folder → `<code>/` prefix, Content-Type, `_meta/<code>.json` sidecar) is mode-common; only the URL builder, CloudFront invalidation, and provisioning differ. Mode is *derived* in `resolveConfig()` (`src/lib/config.ts`), never stored: `domain`+`distributionId` → `cloudfront` (private S3+OAC+CloudFront, HTTPS, Terraform-provisioned); else `bucket`+`region` → `s3-website` (public bucket, HTTP, CLI `setup`).