diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 746a67c..6e8a468 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,6 +40,20 @@ jobs:
             rules/atlas-alerts.yml \
             docker-compose.yml
 
+      - name: Validate Promtail config syntax
+        run: |
+          # Run promtail -check-syntax against the committed config inside
+          # the same image used by the compose stack. The config references
+          # env vars; promtail expands them at parse time when
+          # -config.expand-env=true, with missing vars resolving to an empty
+          # string — fine for a syntax-only check.
+          docker run --rm \
+            -v "$PWD/configs/promtail.yml:/etc/promtail/promtail.yml:ro" \
+            grafana/promtail:3.1.2 \
+            -config.file=/etc/promtail/promtail.yml \
+            -config.expand-env=true \
+            -check-syntax
+
       - name: Validate Grafana dashboard JSON
         run: |
           for f in dashboards/*.json; do
diff --git a/justfile b/justfile
index 9566cab..9327877 100644
--- a/justfile
+++ b/justfile
@@ -78,7 +78,7 @@ clean:
     {{compose_cmd}} down -v
 
 # Validate docker-compose config, YAML files, and required runtime files
-validate: check-env-example
+validate: check-env-example validate-promtail
     #!/usr/bin/env bash
     set -euo pipefail
     {{compose_cmd}} config --quiet
@@ -93,6 +93,17 @@ validate: check-env-example
 check-env-example:
     @bash scripts/check-env-example.sh
 
+# Validate promtail config syntax via the official image's -check-syntax
+validate-promtail:
+    @echo "Validating configs/promtail.yml ..."
+    {{container_cmd}} run --rm \
+        -v "$(pwd)/configs/promtail.yml:/etc/promtail/promtail.yml:ro" \
+        grafana/promtail:3.1.2 \
+        -config.file=/etc/promtail/promtail.yml \
+        -config.expand-env=true \
+        -check-syntax
+    @echo "promtail config OK."
+
 # Hot-reload dev loop for the dashboard (templ generate --watch + air in parallel)
 dev:
     @command -v templ >/dev/null 2>&1 || { echo "templ not found on PATH. Install: go install github.com/a-h/templ/cmd/templ@v0.3.1001"; exit 1; }