diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e7b4a6c..175761f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,7 +1,7 @@
 # The Pester suite, on every push to main and every PR.
 #
 # This repo is one of the twelve on the fleet board
-# (evomedia.net/testsuites.html) and was one of four with no CI at all, so the
+# (evomedia.net/testsuites.html) and was one of three with no CI at all, so the
 # only thing ever running these tests was a workstation at 04:00. That is a
 # poor place for the only copy of a check to live.
 #
@@ -36,17 +36,41 @@ jobs:
       # the repository.
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      # Pinned to 5.x: the suite is written against the v5 configuration API
-      # (New-PesterConfiguration), and Windows images still carry a v3 in the
-      # module path that would be picked ahead of it.
-      - name: Install Pester 5
+      # Pester pinned to 5.x: the suite is written against the v5 configuration
+      # API (New-PesterConfiguration), and Windows images still carry a v3 in
+      # the module path that would be picked ahead of it. PSScriptAnalyzer is
+      # the PowerShell linter; there is no typecheck for PowerShell, so the
+      # analyzer is the whole of that half.
+      - name: Install Pester 5 and PSScriptAnalyzer
         shell: powershell
         run: |
           Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
           Install-Module Pester -MinimumVersion 5.5.0 -MaximumVersion 5.99.99 `
             -Force -SkipPublisherCheck -Scope CurrentUser
+          Install-Module PSScriptAnalyzer -Force -Scope CurrentUser
           Import-Module Pester -MinimumVersion 5.5.0
-          (Get-Module Pester).Version.ToString()
+          'Pester ' + (Get-Module Pester).Version + ', PSScriptAnalyzer ' + (Get-Module -ListAvailable PSScriptAnalyzer | Select-Object -First 1).Version
+
+      # Errors fail the job; warnings are printed and do not. The repo was
+      # written without the analyzer, and turning every style warning into a
+      # red build on day one would make the gate something to disable rather
+      # than something to keep. PSAvoidUsingWriteHost is excluded outright:
+      # these are command-line tools whose Write-Host output IS the interface.
+      - name: Lint (PSScriptAnalyzer)
+        shell: powershell
+        run: |
+          $r = Invoke-ScriptAnalyzer -Path . -Recurse -ExcludeRule PSAvoidUsingWriteHost
+          $warn = @($r | Where-Object Severity -eq Warning)
+          $err  = @($r | Where-Object Severity -eq Error)
+          if ($warn) {
+            Write-Host ("{0} warning(s), not failing the build:" -f $warn.Count)
+            $warn | Format-Table RuleName, ScriptName, Line -AutoSize | Out-String | Write-Host
+          }
+          if ($err) {
+            $err | Format-Table RuleName, ScriptName, Line, Message -AutoSize -Wrap | Out-String | Write-Host
+            throw ("PSScriptAnalyzer: {0} error(s)" -f $err.Count)
+          }
+          Write-Host "no errors"
 
       # -CI sets the exit code from the result, which is the whole point here:
       # Invoke-Pester on its own reports failures and still exits 0, so the