diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
index c806a997..dc701fc5 100644
--- a/.github/workflows/pre-commit.yaml
+++ b/.github/workflows/pre-commit.yaml
@@ -128,12 +128,24 @@ jobs:
 
       - name: Run pre-commit
         id: precommit
+        env:
+          # Skip hooks that auto-fix files — markdownlint (uses --fix) and
+          # terraform_validate (runs terraform init which writes .terraform/).
+          # markdownlint's check-only counterpart runs in the next step;
+          # terraform_validate is covered by tflint instead.
+          SKIP: markdownlint,terraform_validate
         run: |
           pre-commit run --show-diff-on-failure --color=always --all-files
 
+      - name: Run check-only hooks
+        id: precommit-check
+        if: ${{ !cancelled() }}
+        run: |
+          pre-commit run --show-diff-on-failure --color=always --all-files --hook-stage manual
+
       - name: Capture autofix patch
         id: capture
-        if: ${{ failure() && steps.precommit.outcome == 'failure' }}
+        if: ${{ failure() && (steps.precommit.outcome == 'failure' || steps.precommit-check.outcome == 'failure') }}
         run: |
           if git diff --quiet HEAD; then
             echo "pre-commit failed without modifying tracked files; no autofix possible"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 837d3fd8..cfe532a1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -47,8 +47,17 @@ repos:
   - repo: https://github.com/igorshubovych/markdownlint-cli
     rev: v0.49.1
     hooks:
+      # Local: auto-fix markdown issues on commit.
       - id: markdownlint
         args: ['--fix', '--config', '.hooks/linters/markdownlint.json']
+        stages: [pre-commit]
+      # CI: check-only (no file modifications) so the hook never reports
+      # "files were modified" in read-only CI environments.
+      - id: markdownlint
+        alias: markdownlint-check
+        name: markdownlint (check-only)
+        args: ['--config', '.hooks/linters/markdownlint.json']
+        stages: [manual]
 
   - repo: https://github.com/ansible/ansible-lint
     rev: v26.6.0
@@ -74,6 +83,9 @@ repos:
         files: ^(modules|infra)/
       - id: terragrunt_fmt
         files: ^infra/
+      # Skipped in CI (SKIP=terraform_validate) because terraform init
+      # writes .terraform/ which triggers "files were modified". tflint
+      # covers validation in CI instead.
       - id: terraform_validate
         files: ^modules/
         args: