diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f70d35..970f69b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -395,6 +395,14 @@ jobs:
       - name: Check out the repo
         uses: actions/checkout@v6
       - name: Lint SQL
+        # CRITICAL: call `make lint` directly, not some other path (a script, a
+        # different target, etc). lint.mk's vendored include is guarded on
+        # `$(wildcard .git)` so a source tarball (no .git) can still build/install
+        # -- if that guard ever went false here (checkout somehow left no .git),
+        # `lint` wouldn't exist as a target at all, and `make lint` fails loudly
+        # ("No rule to make target 'lint'") rather than silently skipping. Any
+        # wrapper that swallows that exit code or calls a different entry point
+        # would defeat this safety net.
         run: make lint
 
   # cancel-on-close.yml cancels in-flight CI/claude-review runs on PR close by
diff --git a/lint.mk b/lint.mk
index 0d18abf..83cd9e2 100644
--- a/lint.mk
+++ b/lint.mk
@@ -5,7 +5,20 @@
 # Self-initializing (via the rule below) so `make lint` works right after a
 # plain `git clone`, with no --recurse-submodules needed, and so CI can rely
 # on the exact same entry point a developer would use locally.
+#
+# Guarded on $(wildcard .git): the top-level Makefile's `include lint.mk` is
+# unconditional, so Make tries to satisfy this file's own includes before
+# running ANY target. `git archive` (what `make dist`/PGXN ship) drops
+# submodules and .git entirely, so on a released tarball the rule below would
+# run `git submodule update` outside a git repo, fail, and abort the whole
+# Makefile parse -- breaking even plain `make`/`make install` for every
+# consumer, not just `make lint`. Skipping the include there is fine: PGXN
+# consumers don't need the linter. $(wildcard .git) matches both a real
+# .git directory (plain clone) and the .git file pointer used inside a git
+# worktree, and is empty only when neither exists (a tarball extraction).
+ifneq ($(wildcard .git),)
 .vendor/linter/lint.mk:
 	git submodule update --init -- .vendor/linter
 
 include .vendor/linter/lint.mk
+endif