diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 0000000..eba4ccc
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,26 @@
+name: Lint Markdown
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**/*.md'
+      - '.markdownlint-cli2.yaml'
+
+permissions:
+  contents: read
+
+jobs:
+  markdown-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        with:
+          fetch-depth: 0
+
+      - name: Lint Markdown
+        uses: DavidAnson/markdownlint-cli2-action@db43aef879112c3119a410d69f66701e0d530809 # v17.0.0
+        with:
+          globs: '**/*.md'
\ No newline at end of file
diff --git a/.github/workflows/proposals.yml b/.github/workflows/proposals.yml
index 8b2b101..cfc718b 100644
--- a/.github/workflows/proposals.yml
+++ b/.github/workflows/proposals.yml
@@ -3,6 +3,10 @@ on:
   pull_request:
     branches:
       - main
+
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest
@@ -11,10 +15,10 @@ jobs:
       run: |
         git config --global core.autocrlf false
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
       with:
         python-version: '3.11'
         cache: 'pip'
diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml
new file mode 100644
index 0000000..6c8386d
--- /dev/null
+++ b/.markdownlint-cli2.yaml
@@ -0,0 +1,15 @@
+config:
+  line-length: false
+  no-emphasis-as-heading: false
+  code-block-style: false
+  no-inline-html: false
+  ul-style: false
+  no-multiple-blanks: false
+  no-alt-text: false
+  no-bare-urls: false
+globs:
+  - "**/*.md"
+ignores:
+  - ".github/**"
+  - "proposals/**"
+  - ".trestle/**"
\ No newline at end of file