diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 349f80c..5ba7ef0 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -38,7 +38,10 @@ jobs:
           python-version: "3.12"
           cache: "pip"
       - run: pip install ruff
-      - run: ruff check app/
+      # Whole repo, not just app/: tests/ and scripts/ drifted to 11 findings
+      # while unchecked. Rules are pinned in pyproject.toml, so the unpinned
+      # ruff above cannot change what this enforces.
+      - run: ruff check .
 
   test:
     needs: lint
diff --git a/pyproject.toml b/pyproject.toml
index 65930ef..e118f6c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -40,3 +40,21 @@ include = ["app*"]
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]
+
+[tool.ruff]
+target-version = "py312"
+
+[tool.ruff.lint]
+# Pinned explicitly rather than inherited. CI installs ruff unpinned, and the
+# default rule set is not stable across releases: 0.16 broadened it so far that
+# `ruff check app/` went from 0 findings to 376 -- 168 of them B008 flagging
+# FastAPI's `Depends()` in a signature default, which is the framework's
+# documented idiom and not a defect. An unpinned linter with drifting defaults
+# fails the deploy pipeline on code nobody touched, so the rule set is the thing
+# to pin; the ruff version can then float freely.
+#
+# E4 imports, E7 statements, E9 syntax/IO errors, F pyflakes. This is the set the
+# tree was already clean under, now applied repo-wide instead of to app/ alone.
+# Adding rules is welcome -- do it here, deliberately, with the fixes in the same
+# commit.
+select = ["E4", "E7", "E9", "F"]