diff --git a/Dockerfile b/Dockerfile
index 572b041..582c882 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,8 @@
-# Hugo static-site build image. The build runs `make check` (the
-# read-only prettier docs check plus a clean `hugo --minify` production
-# build), so the image build fails on any formatting or Hugo build
-# error. This is what CI (script/cibuild) runs on every push.
+# Hugo static-site build image. The build runs `make check` (a clean
+# `hugo --minify` production build, the `--printPathWarnings` lint
+# build, then the read-only prettier docs check), so the image build
+# fails on any formatting or Hugo build error. This is what CI
+# (script/cibuild) runs on every push.
 # alpine 3.21, 2026-02-28
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 
diff --git a/README.md b/README.md
index dff20fc..1d0610f 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,8 @@ provide:
 - `script/lint` — a clean build that surfaces broken links and path collisions
 - `script/fmt` — format the repo's own top-level markdown docs with prettier
 - `script/fmt-check` — check that formatting (read-only)
-- `script/check` — run `script/fmt-check` then `script/test`; modifies nothing
+- `script/check` — run `script/test`, `script/lint`, then `script/fmt-check`;
+  modifies no tracked files
 - `script/docker` — build the Docker image tagged with the project name
 - `script/cibuild` — the CI build (`docker build .`); the Dockerfile runs
   `make check`
diff --git a/TODO.md b/TODO.md
index 7936071..081abba 100644
--- a/TODO.md
+++ b/TODO.md
@@ -25,6 +25,13 @@ Update `README.md` accordingly.
 
 # Completed Steps
 
+- 2026-08-09: made `script/check` run `script/lint` (closes #9). It previously
+  ran only `fmt-check` then `test`, so `script/lint` executed nowhere — not in
+  `make check`, not in the pre-commit hook, and not in CI, even though the
+  `Dockerfile` runs `make check` and `script/cibuild` builds it. It now runs
+  `test`, `lint`, `fmt-check` in the canonical order, so the
+  `hugo --printPathWarnings` render-target-collision signal is no longer
+  discarded. `README.md`'s Entrypoints line was corrected to match
 - 2026-08-09: hash-pinned every external reference in
   `.gitea/workflows/deploy.yml` (closes #7): both job container images are
   pinned by digest, all three `uses:` are pinned by 40-hex commit SHA, and the
diff --git a/script/check b/script/check
index 7f218e5..f06027f 100755
--- a/script/check
+++ b/script/check
@@ -1,14 +1,16 @@
 #!/bin/sh
 # script/check: run all checks. Our own extension to
-# scripts-to-rule-them-all. Must not modify any files. Runs the
-# read-only formatting check first, then the clean production build.
+# scripts-to-rule-them-all. Must not modify any tracked files. Runs the
+# canonical order: the clean production build, then the lint build that
+# reports path warnings, then the read-only formatting check.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
-    "$SCRIPT_DIR/fmt-check"
     "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/fmt-check"
 }
 
 main "$@"