diff --git a/README.md b/README.md
index 0a0fd41..9532abe 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@ actions, not reusable workflows: Forgejo LTS 11 does not support
 `on: workflow_call`.)
 
 - `node-checks` — npm ci + lint + test (each `--if-present`)
+- `lint-checks` — prettier + eslint + conventional-commit checks (each
+  `--if-present`/config-gated); run after `node-checks` in the same job
 - `build-push` — docker build + push to the Forgejo registry
   (`192.168.1.230:3000`), tags `<short-sha>` + `latest`
 - `gitops-bump` — set the image tag in `nholtware/gitops` via
@@ -22,6 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: http://192.168.1.230:3000/nholtware/workflows/node-checks@main
+      - uses: http://192.168.1.230:3000/nholtware/workflows/lint-checks@main
   deploy:
     needs: checks
     runs-on: host
@@ -38,6 +41,14 @@ jobs:
           gitops-token: ${{ secrets.GITOPS_TOKEN }}
 ```
 
+`lint-checks` expects the consuming repo to define its own tooling: a
+`format:check` npm script (e.g. `prettier --check .`) and a `lint` script
+(e.g. `eslint .`), plus their packages as devDependencies. The
+conventional-commit check only runs if a commitlint config
+(`commitlint.config.*` / `.commitlintrc*`) is present; add
+`@commitlint/cli` + `@commitlint/config-conventional` as devDependencies
+to use it.
+
 Secrets are user-level Actions secrets on the repo owner: `REGISTRY_USER`,
 `REGISTRY_TOKEN` (write:package), `GITOPS_TOKEN` (write on the gitops repo).
 For a non-Node app, drop the `checks` job (or swap in your own) — `deploy`
diff --git a/lint-checks/action.yaml b/lint-checks/action.yaml
new file mode 100644
index 0000000..9d20909
--- /dev/null
+++ b/lint-checks/action.yaml
@@ -0,0 +1,30 @@
+name: lint-checks
+description: >
+  Node formatting, linting, and conventional-commit checks: prettier
+  (`format:check`) and eslint (`lint`) npm scripts, each `--if-present`,
+  plus commitlint if the repo has a commitlint config. Run after
+  actions/checkout and npm ci (e.g. after node-checks), in a job with node
+  available.
+runs:
+  using: composite
+  steps:
+    - run: npm run format:check --if-present
+      shell: bash
+    - run: npm run lint --if-present
+      shell: bash
+    - shell: bash
+      env:
+        GITHUB_EVENT_NAME: ${{ github.event_name }}
+        GITHUB_BASE_REF: ${{ github.base_ref }}
+      run: |
+        set -euo pipefail
+        if ls commitlint.config.* .commitlintrc* >/dev/null 2>&1; then
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+            git fetch origin "$GITHUB_BASE_REF" --depth=1
+            npx --yes commitlint --from "origin/$GITHUB_BASE_REF" --to HEAD
+          else
+            npx --yes commitlint --from HEAD~1 --to HEAD
+          fi
+        else
+          echo "no commitlint config found, skipping conventional-commit check"
+        fi