diff --git a/.gitea/workflows/ruff-lint.yml b/.gitea/workflows/ruff-lint.yml
new file mode 100644
index 0000000..fe8227b
--- /dev/null
+++ b/.gitea/workflows/ruff-lint.yml
@@ -0,0 +1,31 @@
+# Gitea Actions: Ruff Lint Check
+#
+# Runs ruff on every PR to main to catch violations before merge.
+# Complements the local pre-commit hook — violations blocked here even if
+# the developer bypassed the hook with --no-verify.
+
+name: Ruff Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Set up Python
+        uses: https://github.com/actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff check
+        run: ruff check .
diff --git a/ruff.toml b/ruff.toml
index 7dfbf5b..1b5220c 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -2,10 +2,36 @@
 # See https://docs.astral.sh/ruff/configuration/
 
 [lint]
-# F403/F405: star imports from exceptions.py are intentional — exceptions module
-#            exports a curated set of project exceptions via __all__
-# F541: f-strings without placeholders — cosmetic, low risk
-# F401: unused imports — many are re-exported or used conditionally
-# F841: unused variables — often intentional in SQLModel session patterns
-# E712: SQLAlchemy/SQLModel ORM comparisons to True/False require == syntax
-ignore = ["F403", "F405", "F541", "F401", "F841", "E712"]
+# Rules suppressed globally because they reflect intentional project patterns:
+#   F403/F405: star imports — __init__.py files use `from .module import *` for re-exports
+#   E712:      SQLAlchemy/SQLModel ORM comparisons require == syntax (not `is`)
+#   F541:      f-strings without placeholders — 1000+ legacy occurrences; cosmetic, deferred
+ignore = ["F403", "F405", "F541", "E712"]
+
+# Per-file suppressions for pre-existing violations in legacy code.
+# New files outside these paths get the full rule set.
+# Remove entries here as files are cleaned up.
+[lint.per-file-ignores]
+# Core cogs — F841/F401 widespread; E711/E713/F811 pre-existing
+"cogs/**" = ["F841", "F401", "E711", "E713", "F811"]
+# Game engine — F841/F401 widespread; E722/F811 pre-existing bare-excepts and redefinitions
+"in_game/**" = ["F841", "F401", "E722", "F811"]
+# Helpers — F841/F401 widespread; E721/E722 pre-existing type-comparison and bare-excepts
+"helpers/**" = ["F841", "F401", "E721", "E722"]
+# Game logic and commands
+"command_logic/**" = ["F841", "F401"]
+# Test suite — E711/F811/F821 pre-existing test assertion patterns
+"tests/**" = ["F841", "F401", "E711", "F811", "F821"]
+# Utilities
+"utilities/**" = ["F841", "F401"]
+# Migrations
+"migrations/**" = ["F401"]
+# Top-level legacy files
+"db_calls_gameplay.py" = ["F841", "F401"]
+"gauntlets.py" = ["F841", "F401"]
+"dice.py" = ["F841", "E711"]
+"manual_pack_distribution.py" = ["F841"]
+"play_lock.py" = ["F821"]
+"paperdynasty.py" = ["F401"]
+"api_calls.py" = ["F401"]
+"health_server.py" = ["F401"]