diff --git a/.tflint.hcl b/.tflint.hcl
new file mode 100644
index 0000000..5684481
--- /dev/null
+++ b/.tflint.hcl
@@ -0,0 +1,13 @@
+plugin "terraform" {
+  enabled = true
+  preset  = "recommended"
+}
+
+plugin "azurerm" {
+  enabled = true
+  version = "0.28.0"
+  source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
+}
+
+# Azurerm rules — installed but NOT enforced yet. Enablement deferred to Phase 4.
+# Individual rule enables go here after Phase 1 4.x migration is complete.