diff --git a/.github/actions/preflight/action.yml b/.github/actions/preflight/action.yml
new file mode 100644
index 000000000..dd78d6888
--- /dev/null
+++ b/.github/actions/preflight/action.yml
@@ -0,0 +1,31 @@
+name: Preflight
+description: |
+  Cheap lint + format gate that runs before expensive CI jobs (regression
+  shards, perf shards, parity renders, Windows renders, catalog previews).
+  Single source of truth for the gate's bun/node/cache/lint/format steps —
+  tweak here and every preflight job picks it up.
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: 22
+
+    - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      with:
+        path: ~/.bun/install/cache
+        key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+        restore-keys: |
+          bun-${{ runner.os }}-
+
+    - shell: bash
+      run: bun install --frozen-lockfile
+
+    - shell: bash
+      run: bun run lint
+
+    - shell: bash
+      run: bun run format:check
diff --git a/.github/workflows/catalog-previews.yml b/.github/workflows/catalog-previews.yml
index ec57ae420..3c6263979 100644
--- a/.github/workflows/catalog-previews.yml
+++ b/.github/workflows/catalog-previews.yml
@@ -17,8 +17,17 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  preflight:
+    name: Preflight (lint + format)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ./.github/actions/preflight
+
   render-previews:
     name: Render catalog previews
+    needs: preflight
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
diff --git a/.github/workflows/player-perf.yml b/.github/workflows/player-perf.yml
index 9c4e0532a..5a4926079 100644
--- a/.github/workflows/player-perf.yml
+++ b/.github/workflows/player-perf.yml
@@ -37,14 +37,24 @@ jobs:
               - "bun.lock"
               - ".github/workflows/player-perf.yml"
 
+  preflight:
+    name: Preflight (lint + format)
+    needs: changes
+    if: needs.changes.outputs.perf == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ./.github/actions/preflight
+
   perf-shards:
     name: "Perf: ${{ matrix.shard }}"
-    needs: changes
+    needs: [changes, preflight]
     if: needs.changes.outputs.perf == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - shard: load
diff --git a/.github/workflows/preview-regression.yml b/.github/workflows/preview-regression.yml
index 9049992a9..af1bf93a9 100644
--- a/.github/workflows/preview-regression.yml
+++ b/.github/workflows/preview-regression.yml
@@ -41,9 +41,19 @@ jobs:
               - "bun.lock"
               - ".github/workflows/preview-regression.yml"
 
+  preflight:
+    name: Preflight (lint + format)
+    needs: changes
+    if: needs.changes.outputs.preview == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ./.github/actions/preflight
+
   preview-parity:
     name: Preview parity
-    needs: changes
+    needs: [changes, preflight]
     if: needs.changes.outputs.preview == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 20
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index fba816771..62e2bc503 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -34,13 +34,23 @@ jobs:
               - "packages/engine/**"
               - "Dockerfile*"
 
-  regression-shards:
+  preflight:
+    name: Preflight (lint + format)
     needs: changes
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ./.github/actions/preflight
+
+  regression-shards:
+    needs: [changes, preflight]
+    if: needs.changes.outputs.code == 'true'
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         # Shards are bin-packed by measured per-test duration (LPT heuristic on
         # CI run 25893372795) so each row carries ~15-16 min of work. When a
diff --git a/.github/workflows/windows-render.yml b/.github/workflows/windows-render.yml
index 1490a97f2..f5e8f19f1 100644
--- a/.github/workflows/windows-render.yml
+++ b/.github/workflows/windows-render.yml
@@ -57,9 +57,21 @@ jobs:
               - "bun.lock"
               - ".github/workflows/windows-render.yml"
 
+  preflight:
+    name: Preflight (lint + format)
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ github.event.inputs.ref }}
+      - uses: ./.github/actions/preflight
+
   render-windows:
     name: Render on windows-latest
-    needs: changes
+    needs: [changes, preflight]
     if: needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: windows-latest
     timeout-minutes: 30
@@ -344,7 +356,7 @@ jobs:
   # -------------------------------------------------------------------
   test-windows:
     name: Tests on windows-latest
-    needs: changes
+    needs: [changes, preflight]
     if: needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: windows-latest
     timeout-minutes: 20