diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd11833..83676ee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,11 +54,11 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: result-*
 
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..ac99203
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,49 @@
+name: Lint
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '**.h'
+      - '**.cxx'
+      - '**.py'
+      - 'pyproject.toml'
+      - '.github/workflows/lint.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  clang-format:
+    name: clang-format
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      # The whole tree is formatted, so check it whole: no diff-vs-base
+      # machinery, and drift cannot accumulate in untouched files.
+      - name: Check C++ formatting
+        run: |
+          sudo apt-get install -y clang-format-18
+          find src test/cpp -name '*.cxx' -o -name '*.h' \
+            | xargs clang-format-18 --dry-run -Werror
+
+  ruff:
+    name: ruff
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Check python lint and formatting
+        run: |
+          pip install ruff==0.16.3
+          ruff check .
+          ruff format --check .
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index a452156..75cd1ef 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -63,7 +63,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             const marker = '<!-- cppjit-nightly-drift -->';