diff --git a/.github/workflows/cfengine_lint.yml b/.github/workflows/cfengine_lint.yml
new file mode 100644
index 0000000000..2190a92839
--- /dev/null
+++ b/.github/workflows/cfengine_lint.yml
@@ -0,0 +1,20 @@
+name: Lint policy with CFEngine CLI
+on:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  lint:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+      - name: Checkout masterfiles
+        uses: actions/checkout@v4
+      - name: Install CFEngine CLI
+        run: pipx install cfengine
+      - name: Run cfengine lint
+        run: |
+          cfengine lint --strict no ./
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 367b031ce5..c957ad52a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,10 @@ on:
 jobs:
   style_check:
     uses: ./.github/workflows/style_check.yml
+  cfengine_lint:
+    uses: ./.github/workflows/cfengine_lint.yml
   bootstrap_policy_run_check:
-    needs: style_check
+    needs: [style_check, cfengine_lint]
     uses: ./.github/workflows/bootstrap_policy_run_check.yml
   tests:
     needs: bootstrap_policy_run_check