diff --git a/ruff.toml b/ruff.toml
new file mode 100644
index 0000000..cfae84a
--- /dev/null
+++ b/ruff.toml
@@ -0,0 +1,4 @@
+# canary/ is the intentionally-vulnerable scanner-recall corpus: it must stay
+# byte-stable (canary-meta/KEY.md keys findings to its line numbers) and linting
+# deliberately-bad code is meaningless, so ruff skips it entirely.
+extend-exclude = ["canary"]
diff --git a/test_imports.py b/test_imports.py
new file mode 100644
index 0000000..053a012
--- /dev/null
+++ b/test_imports.py
@@ -0,0 +1,13 @@
+"""Import smoke test.
+
+CI runs `pytest --collect-only` as an import check; collection imports this
+module, which imports the repo's Python entry points. No API calls are made
+(cross_review imports the openai SDK lazily, inside the call path).
+"""
+
+import cross_review
+
+
+def test_cross_review_importable():
+    assert cross_review.DEFAULT_MODEL == "gpt-4.1"
+    assert "BLOCK" in cross_review.CROSS_REVIEWER_PROMPT