diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 83f20c3..d12703d 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -36,6 +36,12 @@ on:
       test:      { type: string, default: "@stack" }
       build:     { type: string, default: "@stack" }
 
+      # Design-system verifier (oxlint + @shadcn/lint). Opt-in: no `@stack`
+      # default, since there is no conventional command for it. Runs on the
+      # light pool right after Lint. Advisory until the caller's command adds
+      # `--max-warnings`.
+      design-lint: { type: string, default: "" }
+
       light-weight: { type: string, default: "light" }
       heavy-weight: { type: string, default: "heavy" }
 
@@ -210,6 +216,7 @@ jobs:
           install:         ${{ inputs.install }}
           lint:            ${{ inputs.lint }}
           typecheck:       ${{ inputs.typecheck }}
+          design-lint:     ${{ inputs.design-lint }}
           java-version:    ${{ inputs.java-version }}
           node-version:    ${{ inputs.node-version }}
           bun-version:     ${{ inputs.bun-version }}
@@ -231,6 +238,12 @@ jobs:
           set -euo pipefail
           . "${{ steps.setup.outputs.env-file }}"
           ${{ steps.setup.outputs.lint }}
+      - name: Design lint
+        if: steps.setup.outputs.design-lint != ''
+        run: |
+          set -euo pipefail
+          . "${{ steps.setup.outputs.env-file }}"
+          ${{ steps.setup.outputs.design-lint }}
       - name: Typecheck
         if: steps.setup.outputs.typecheck != ''
         run: |
@@ -368,6 +381,7 @@ jobs:
           typecheck:       ${{ inputs.typecheck }}
           test:            ${{ inputs.test }}
           build:           ${{ inputs.build }}
+          design-lint:     ${{ inputs.design-lint }}
           java-version:    ${{ inputs.java-version }}
           node-version:    ${{ inputs.node-version }}
           bun-version:     ${{ inputs.bun-version }}
@@ -386,6 +400,12 @@ jobs:
           set -euo pipefail
           . "${{ steps.setup.outputs.env-file }}"
           ${{ steps.setup.outputs.lint }}
+      - name: Design lint
+        if: steps.setup.outputs.design-lint != ''
+        run: |
+          set -euo pipefail
+          . "${{ steps.setup.outputs.env-file }}"
+          ${{ steps.setup.outputs.design-lint }}
       - name: Typecheck
         if: steps.setup.outputs.typecheck != ''
         run: |
diff --git a/README.md b/README.md
index 4b18350..cd95031 100644
--- a/README.md
+++ b/README.md
@@ -297,6 +297,22 @@ There used to be a caller template per stack. It failed the way templates fail:
 the Gradle one carried one product's task name, in a file every other Gradle repo
 was told to copy.
 
+### Design lint
+
+An optional step for a design-system verifier (oxlint hosting `@shadcn/lint`),
+separate from `lint` because it has its own exit code and its own ratchet.
+Default `""` means the step does not exist -- every caller pinned at `@v1` is
+unaffected until it opts in. No `@stack` default: there is no conventional
+command for this, on any stack.
+
+```yaml
+with:
+  design-lint: bun run lint:design --format=github
+```
+
+Warnings are advisory. `--max-warnings N` in the caller's own command is the
+ratchet -- tighten it there as the count comes down.
+
 ### One job or three
 
 `pr-checks.yml` splits light work from heavy by default. `single-job: true`
diff --git a/actions/setup-stack/action.yml b/actions/setup-stack/action.yml
index 1b80930..4b87ef6 100644
--- a/actions/setup-stack/action.yml
+++ b/actions/setup-stack/action.yml
@@ -89,6 +89,12 @@ inputs:
   typecheck: { description: 'Override the typecheck command', default: '@stack' }
   test:      { description: 'Override the test command',      default: '@stack' }
   build:     { description: 'Override the build command',     default: '@stack' }
+  design-lint:
+    description: >-
+      Design-system lint command (e.g. `bun run lint:design` running oxlint +
+      @shadcn/lint). Empty means no step. No `@stack` default: this is opt-in
+      per repo.
+    default: ''
 
 outputs:
   env-file:
@@ -111,6 +117,9 @@ outputs:
   build:
     description: 'Resolved build command. Empty means skip.'
     value: ${{ steps.defaults.outputs.build }}
+  design-lint:
+    description: 'Resolved design-lint command. Empty means skip.'
+    value: ${{ steps.defaults.outputs.design-lint }}
 
 runs:
   using: composite
@@ -276,6 +285,7 @@ runs:
         O_TYPECHECK: ${{ inputs.typecheck }}
         O_TEST:      ${{ inputs.test }}
         O_BUILD:     ${{ inputs.build }}
+        O_DESIGN_LINT: ${{ inputs.design-lint }}
       run: |
         set -euo pipefail
         install=""; lint=""; typecheck=""; test=""; build=""
@@ -324,3 +334,5 @@ runs:
         emit typecheck "$(pick "$O_TYPECHECK" "$typecheck")"
         emit test      "$(pick "$O_TEST" "$test")"
         emit build     "$(pick "$O_BUILD" "$build")"
+        # No conventional command for any stack: this is opt-in only.
+        emit design-lint "$(pick "$O_DESIGN_LINT" "")"