diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 96191e4..42c2d21 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -38,6 +38,25 @@ jobs:
       - name: Test
         run: cargo test --features ssr
 
+      # Every plan under plans/ built deterministically and held to the
+      # lint, both by this very portal: a builder change that renders a
+      # site the lint rejects fails here, not at the next training run.
+      # (portal-trainer's CI did this until the trainer moved in.)
+      - name: Build and lint every plan
+        run: |
+          set -euo pipefail
+          cargo build --features ssr --bin portal
+          bin="$CARGO_TARGET_DIR/debug/portal"
+          tmp=$(mktemp -d)
+          lint="$tmp/portal-lint"
+          printf '#!/bin/sh\nexec %s lint "$@"\n' "$bin" > "$lint" && chmod +x "$lint"
+          for plan in plans/*.yaml; do
+            name=$(basename "$plan" .yaml)
+            echo "== $plan"
+            rm -rf "$tmp/plan-$name"
+            "$bin" build --plan "$plan" --out "$tmp/plan-$name" --lint "$lint"
+          done
+
       - name: Stop the throwaway JetStream
         if: always()
         run: docker rm -f portal-test-nats >/dev/null 2>&1 || true