diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml
index 6b43a48..955e39c 100644
--- a/.gitea/workflows/lint.yml
+++ b/.gitea/workflows/lint.yml
@@ -1,8 +1,13 @@
-# PSScriptAnalyzer + Python lint — runs on every push/PR that touches code files.
-# Requires PSScriptAnalyzer installed on the runner host:
-#   Install-Module PSScriptAnalyzer -Scope AllUsers -Force
+# Python lint runs on every push/PR (linux-build runner) and blocks the PR.
 #
-# Failures block the PR. Fix warnings with:
+# PSScriptAnalyzer (pssa) runs on the Windows runner (windows-build) on-demand
+# only — triggered via workflow_dispatch — because the .ps1/.psm1 targets are
+# Windows-native (PS 5.1). It is intentionally NOT queued on push/PR so it does
+# not block the pipeline when no Windows runner is registered (dual-boot Passo 9
+# may be down). This keeps the Linux host/runner free of pwsh (Phase C goal).
+# Requires PSScriptAnalyzer installed on the Windows runner host:
+#   Install-Module PSScriptAnalyzer -Scope AllUsers -Force
+# Fix warnings with:
 #   Invoke-ScriptAnalyzer -Path scripts\ -Recurse -Fix
 
 
@@ -27,7 +32,10 @@ on:
 
 jobs:
   pssa:
-    runs-on: linux-build
+    # On-demand only: runs on the Windows runner (PS 5.1), never on push/PR,
+    # so it cannot block the pipeline when no Windows runner is registered.
+    if: ${{ github.event_name == 'workflow_dispatch' }}
+    runs-on: windows-build
     timeout-minutes: 10
 
     steps:
@@ -37,7 +45,7 @@ jobs:
           fetch-depth: 1
 
       - name: Run PSScriptAnalyzer
-        shell: pwsh
+        shell: powershell
         run: |
           $ErrorActionPreference = 'Stop'