diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce80cbb..20fc0f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,30 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+
+      - name: Install lint deps
+        run: |
+          pip install -r requirements.txt
+          pip install -r requirements-dev.txt
+
+      - name: Ruff
+        run: ruff check lambda tests cdk
+
+      - name: Mypy
+        run: mypy tests
+
   test:
     runs-on: ubuntu-latest
     steps:
diff --git a/Makefile b/Makefile
index dc3649a..398c758 100644
--- a/Makefile
+++ b/Makefile
@@ -1,12 +1,19 @@
-# Agent-friendly check: shortest path = correct path (pytest + cdk synth).
-# No deploy. Requires: pip install -r requirements.txt and -r cdk/requirements.txt; Node for npx.
+# Agent-friendly check: shortest path = correct path.
+# No deploy. Requires: pip install -r requirements.txt -r requirements-dev.txt
+# and -r cdk/requirements.txt; Node for npx.
 
-.PHONY: check test synth
+.PHONY: check test synth lint typecheck
 
 test:
 	PYTHONPATH=. pytest tests/test_exclusao.py -v
 
+lint:
+	ruff check lambda tests cdk
+
+typecheck:
+	mypy tests
+
 synth:
 	npx --yes aws-cdk@2 synth
 
-check: test synth
+check: lint typecheck test synth
diff --git a/README.md b/README.md
index c6ac21b..c63db36 100644
--- a/README.md
+++ b/README.md
@@ -40,15 +40,16 @@ Cada solicitação grava **dois** itens (histórico depois ponteiro):
 
 ```bash
 pip install -r requirements.txt
+pip install -r requirements-dev.txt   # ruff + mypy
 pip install -r cdk/requirements.txt   # só se for rodar synth
 PYTHONPATH=. pytest tests/test_exclusao.py -v
-# ou o caminho curto (pytest + cdk synth, sem deploy):
+# caminho curto (lint + types + pytest + cdk synth, sem deploy):
 make check
 ```
 
 Usa **moto** (sem AWS real). O pacote `lambda/` importa via `importlib` (nome reservado).
 
-CI (GitHub Actions): em todo PR/`push` na `main` — job **`test`** (pytest/moto, Python 3.12) e job **`synth`** (`npx aws-cdk@2 synth`, sem credenciais AWS / sem deploy).
+CI (GitHub Actions): em todo PR/`push` na `main` — jobs **`lint`** (ruff + mypy), **`test`** (pytest/moto) e **`synth`** (`npx aws-cdk@2 synth`, sem AWS / sem deploy).
 
 ---
 
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 0000000..716f504
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,31 @@
+[project]
+name = "aws-lambda-api-gateway-python"
+version = "0.0.0"
+requires-python = ">=3.12"
+
+[tool.ruff]
+target-version = "py312"
+line-length = 100
+src = ["lambda", "tests", "cdk"]
+
+[tool.ruff.lint]
+# Hard constraints (Lauren/pstack): errors + unused. Import-sort (I) deferred —
+# CDK multi-alias imports fight isort without value; enable in a later PR.
+select = ["E", "F", "W"]
+ignore = ["E501"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["E402"]
+
+[tool.mypy]
+python_version = "3.12"
+ignore_missing_imports = true
+warn_return_any = false
+warn_unused_configs = true
+check_untyped_defs = false
+# `lambda/` is a reserved package name; CDK stubs are heavy — typecheck tests only for now.
+files = ["tests"]
+
+[[tool.mypy.overrides]]
+module = "lambda.*"
+ignore_errors = true
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 0000000..15bfc55
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,3 @@
+# Dev / CI lint+types (not required at Lambda runtime)
+ruff>=0.8.0
+mypy>=1.13.0