diff --git a/.github/workflows/ci-gate.yml b/.github/workflows/ci-gate.yml
index eea57c7..8bb7aaa 100644
--- a/.github/workflows/ci-gate.yml
+++ b/.github/workflows/ci-gate.yml
@@ -60,6 +60,7 @@ jobs:
               - '**.tf'
               - '**.tfvars'
               - '.terraform.lock.hcl'
+              - '.tflint.hcl'
               - 'tests/**'
 
   # ==========================================================================
diff --git a/.tflint.hcl b/.tflint.hcl
index 7aa2005..1f599e0 100644
--- a/.tflint.hcl
+++ b/.tflint.hcl
@@ -8,6 +8,15 @@ plugin "terraform" {
   preset  = "recommended"
   version = "0.15.0"
   source  = "github.com/terraform-linters/tflint-ruleset-terraform"
+
+  # TEMPORARY (2026-07-17): pinned to PGP because the default "auto" mode
+  # crashes. GitHub removed the `bundle` field from attestation API responses,
+  # so tflint >=0.61 nil-derefs while verifying this plugin and never reaches
+  # the lint stage. Upstream fix: terraform-linters/tflint#2593 (unreleased).
+  # "pgp" still verifies the plugin cryptographically via the legacy signing
+  # key -- it is NOT "none", which would skip verification entirely.
+  # REVERT to the default (delete this line) once #2593 ships.
+  signature = "pgp"
 }
 
 rule "terraform_documented_variables" {