diff --git a/.woodpecker/lint.yaml b/.woodpecker/lint.yaml
index 92c873c..cca5f57 100644
--- a/.woodpecker/lint.yaml
+++ b/.woodpecker/lint.yaml
@@ -17,3 +17,35 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
+
+  # stylua ships no apk package, so pull the pinned musl release through the
+  # artifact proxy and check the checksum. The proxy's TLS leaf chains to the
+  # internal CA, which alpine does not trust, so fetch over the plain-HTTP
+  # listener and let the digest carry integrity.
+  - name: fmt
+    image: alpine:3.22
+    environment:
+      STYLUA_VERSION: v2.5.2
+      STYLUA_SHA256: ca6f1cf52eaf69e6632b81acef9c197aa24b85eb30d2455a35e7dbe28ae77c72
+    commands:
+      - apk add --no-cache curl unzip make
+      - |
+        HOST="http://artifactapi.k8s.syd1.au.unkin.net"
+        ZIP="stylua-linux-x86_64-musl.zip"
+        curl -fsSL -o /tmp/$$ZIP \
+          "$$HOST/api/v1/remote/github/JohnnyMorganz/StyLua/releases/download/$${STYLUA_VERSION}/$$ZIP"
+        echo "$${STYLUA_SHA256}  /tmp/$$ZIP" | sha256sum -c -
+        unzip -o -d /usr/local/bin /tmp/$$ZIP
+        chmod +x /usr/local/bin/stylua
+      - stylua --version
+      - make fmt-check
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 500m
+          limits:
+            memory: 1Gi
+            cpu: 1
diff --git a/Makefile b/Makefile
index fafd95e..3c510f2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: test lint fmt pre-commit package verify-package patch minor major _tag
+.PHONY: test lint fmt fmt-check pre-commit package verify-package patch minor major _tag
 
 VERSION ?= $(shell git describe --tags --always)
 # Archive names drop the leading "v", the way tag source archives do.
@@ -12,8 +12,13 @@ test:
 lint:
 	luacheck lua tests
 
+LUA_SOURCES = lua tests plugin
+
 fmt:
-	stylua lua tests
+	stylua $(LUA_SOURCES)
+
+fmt-check:
+	stylua --check $(LUA_SOURCES)
 
 pre-commit:
 	@uvx pre-commit run --all-files
diff --git a/tests/installer_spec.lua b/tests/installer_spec.lua
index 330612d..b1ec306 100644
--- a/tests/installer_spec.lua
+++ b/tests/installer_spec.lua
@@ -60,9 +60,12 @@ local function run(ctx, specs)
   installer.run(ctx, specs, function(r)
     results = r
   end)
-  assert(vim.wait(30000, function()
-    return results ~= nil
-  end, 20), 'installer.run never called back')
+  assert(
+    vim.wait(30000, function()
+      return results ~= nil
+    end, 20),
+    'installer.run never called back'
+  )
   return results
 end