diff --git a/.gitea/workflows/validate.yml b/.gitea/workflows/validate.yml
new file mode 100644
index 0000000..4f7b556
--- /dev/null
+++ b/.gitea/workflows/validate.yml
@@ -0,0 +1,24 @@
+name: Validate actions
+
+# Lint-only workflow: this repo holds reusable composite actions, so there is
+# nothing to build — validation via pre-commit is the whole pipeline.
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  validate:
+    runs-on:
+      - linux
+      - build
+      - amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run pre-commit hooks
+        run: |
+          set -euo pipefail
+          pre-commit run --all-files --show-diff-on-failure
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b193340..b7737c0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -19,3 +19,10 @@ repos:
     hooks:
       - id: detect-secrets
         args: [ "--baseline", ".secrets.baseline" ]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint
+        args: [ "-config-file", "actionlint.yaml" ]
+        files: ^\.gitea/workflows/.*\.ya?ml$
diff --git a/actionlint.yaml b/actionlint.yaml
new file mode 100644
index 0000000..0dd419c
--- /dev/null
+++ b/actionlint.yaml
@@ -0,0 +1,6 @@
+self-hosted-runner:
+  labels:
+    - linux
+    - build
+    - amd64
+    - arm64