diff --git a/.drone.yml b/.drone.yml
index 4ec3f0b..3aa04f7 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -14,6 +14,15 @@ trigger:
     - push
 
 steps:
+  # Lint/format gate (Phase 1b, RL1). Runs the exact toolchain from the pinned `lint` devshell
+  # (flake.nix) via scripts/lint.sh in check mode — FAILS the build on any unclean file so future
+  # commits stay formatted + lint-clean. HOME=/root so nix reuses root's store/eval cache.
+  - name: lint
+    environment:
+      HOME: /root
+    commands:
+      - nix develop .#lint --command bash scripts/lint.sh
+
   - name: hello
     commands:
       - echo "cc-ci self-test on the exec runner"