diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f3bd79..1ec6e9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,6 +39,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Lint
+        run: npm run lint:check
+
       - name: Build
         run: npm run build
 
diff --git a/context/progress-tracker.md b/context/progress-tracker.md
index 648f6d5..c01387a 100644
--- a/context/progress-tracker.md
+++ b/context/progress-tracker.md
@@ -6,7 +6,9 @@ pure chore/docs commits). Direct pushes to main must also be logged here.
 
 ---
 
-## 2026-07-23
+## 2026-07-28
+
+- Added `lint:check` script to package.json (ESLint with `--max-warnings=0`, no `--fix`) and a Lint step to CI after Install dependencies, so `no-explicit-any` is enforced on every PR. The existing `lint` script with `--fix` is unchanged for local use.
 
 - Added GitHub Actions health check workflow (`health-check.yml`) to ping the Render API every 6 hours to prevent the free tier instance from sleeping. Auto-creates or comments on issues with the `incident` label if the ping fails, preventing silent outages.
 - Documented the ping URL and incident label in README.
diff --git a/package.json b/package.json
index eb008d9..838d6b5 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
     "start:debug": "npx nest start --debug --watch",
     "start:prod": "node dist/main",
     "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "lint:check": "eslint \"{src,apps,libs,test}/**/*.ts\" --max-warnings=0",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:cov": "jest --coverage",