diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..4c832fc
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,55 @@
+name: lint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  clippy:
+    name: clippy (rust)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cache cargo build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: lint-clippy-${{ hashFiles('**/Cargo.lock') }}
+
+      # Allow-list explained:
+      # - op_ref / needless_borrow / manual_range_contains / too_many_arguments:
+      #   stylistic lints that fire in audited code byte-identical with
+      #   lazorkit-protocol. Touching them changes audited bytes and
+      #   triggers an unnecessary delta audit on cosmetic refactors.
+      # - unused_mut: same — appears in a test closure in state/action.rs.
+      # When the audit baseline rolls over, revisit and tighten this list.
+      - name: cargo clippy (devnet features)
+        run: |
+          cargo clippy --features devnet --all-targets -- \
+            -D warnings \
+            -A clippy::op_ref \
+            -A clippy::needless_borrow \
+            -A clippy::manual_range_contains \
+            -A clippy::too_many_arguments \
+            -A unused_mut
+
+# tsc on tests-sdk is intentionally NOT included here.
+#
+# tests-sdk depends on `@lazorkit/sdk-legacy` via a `file:` link to the
+# sibling lazorkit-protocol checkout, which doesn't exist in CI. Wiring
+# this up cleanly requires switching to the npm-published version
+# (^0.3.1+) once it lands, then restoring the tsc job.
+#
+# Type errors are still caught locally via `npx tsc --noEmit` from
+# tests-sdk against the file: linked SDK.