diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42e8892d..95b0805d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,10 +7,35 @@ on:
   pull_request:
 
 permissions:
-  checks: write
   contents: read
 
 jobs:
+  # Runs the linters directly so the job itself passes or fails. Reporting via
+  # separate check runs (e.g. wearerequired/lint-action) needs `checks: write`,
+  # which GitHub never grants to pull_request runs from forks, leaving those
+  # required checks permanently pending.
+  lint:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: npm install
+        run: npm install
+
+      - name: ESLint
+        run: npm run lint -- --max-warnings 0
+
+      - name: Prettier
+        run: npm run format:check
+
   build:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
@@ -47,16 +72,6 @@ jobs:
       - name: npm install
         run: npm install
 
-      - name: Lint
-        uses: wearerequired/lint-action@v2
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          prettier: true
-          prettier_extensions: js,cjs,mjs,md,json,yml,yaml
-          eslint: true
-          eslint_args: '--max-warnings 0'
-          eslint_extensions: js,mjs,cjs
-
       - name: Build
         run: npm run build