diff --git a/.gitea/workflows/validate.yaml b/.gitea/workflows/validate.yaml
new file mode 100644
index 0000000..16ef198
--- /dev/null
+++ b/.gitea/workflows/validate.yaml
@@ -0,0 +1,32 @@
+name: Renovate Config Validation
+
+on:
+  workflow_call:
+    inputs:
+      config_path:
+        description: "Path to the Renovate config to validate (a renovate.json in the calling repo). Non-blocking when absent."
+        required: false
+        type: string
+        default: "renovate.json"
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    container: renovate/renovate:43
+    steps:
+      - name: Checkout caller repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Validate the repo's Renovate config
+        run: |
+          FILE="${{ inputs.config_path }}"
+          if [ ! -f "$FILE" ]; then
+            echo "No Renovate config at $FILE — skipping validation (this repo has no renovate.json)."
+            exit 0
+          fi
+          echo "Validating $FILE"
+          # renovate-config-validator parses the file against the official
+          # Renovate schema and catches: invalid fields, bad regexes in
+          # customManagers, forbidden *Template fields (e.g. registryUrlsTemplate),
+          # malformed packageRules, etc. It does NOT run Renovate itself.
+          renovate-config-validator "$FILE"