diff --git a/.trunk/.gitignore b/.trunk/.gitignore
new file mode 100644
index 00000000000..1e24652901a
--- /dev/null
+++ b/.trunk/.gitignore
@@ -0,0 +1,8 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index e69de29bb2d..6ddd777b631 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -0,0 +1,83 @@
+---
+# =============================================================================
+# Trunk.io — Plugin versions for linting/formatting tools
+# =============================================================================
+# This file is auto-generated. Run `trunk upgrade` to update.
+# https://docs.trunk.io/check/reference
+# =============================================================================
+
+version: 0.1
+
+# CLI version pinned for reproducible runs (matches the version CI downloads).
+cli:
+    version: 1.22.2
+
+# The `trunk` plugin provides the linter/formatter definitions used below.
+# User definitions merge over the plugin: fields set in this file override the
+# plugin, everything else (files, tools, runtimes, version pins) is inherited.
+plugins:
+    sources:
+        - id: trunk
+          ref: v1.11.0
+          uri: https://github.com/trunk-io/plugins
+
+lint:
+    # Repo-specific command overrides merged over the plugin definitions.
+    definitions:
+        # black: enforce 100-char line length in both lint and format modes.
+        - name: black
+          commands:
+              - name: lint
+                output: pass_fail
+                run: black --check --line-length 100 ${target}
+                success_codes: [0, 1]
+              - name: format
+                output: rewrite
+                run: black --line-length 100 ${target}
+                success_codes: [0]
+                batch: true
+                in_place: true
+                formatter: true
+        # clippy: lint all targets/features and fail on any warning.
+        - name: clippy
+          commands:
+              - name: lint
+                output: clippy
+                target: ${parent_with(Cargo.toml)}
+                run: >
+                    cargo clippy --message-format json --all-targets
+                    --all-features
+                    --locked -- -D warnings
+                success_codes: [0, 101, 383]
+                disable_upstream: true
+
+    # Enabled tools (plugin defaults unless overridden above). Versions are
+    # pinned explicitly: an unpinned entry resolves to the SYSTEM copy of the
+    # tool instead of a trunk-managed install.
+    enabled:
+        - actionlint@1.7.8
+        - black@25.9.0
+        - clippy@1.88.0
+        - eslint@8.10.0
+        - golangci-lint@2.6.1
+        - mypy@2.1.0
+        - prettier@3.6.2
+        - ruff@0.16.2
+        - rustfmt@1.88.0
+        - shellcheck@0.10.0
+        - taplo@0.10.0
+        - yamllint@1.37.1
+
+    # GitHub workflow files are covered by actionlint (syntax + shellcheck).
+    # prettier's YAML printer re-indents `on:`-keyed workflow files with a
+    # nonstandard style, and yamllint's 80-column default flags long action
+    # refs; neither reflects this repo's intent, so scope both off workflows.
+    ignore:
+        - linters: [prettier, yamllint]
+          paths:
+              - .github/workflows/**
+
+# Git hooks: run `trunk check` before `git push`.
+actions:
+    enabled:
+        - trunk-check-pre-push