diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 0000000..a260f2c
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: 2026 Sephyi <me@sephy.io>
+#
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
+
+# Minimal, pragmatic clippy config to catch common anti-patterns at lint time.
+#
+# Keep this file small. Each rule should have a clear justification in its
+# `reason` so reviewers understand why the flagged call was blocked.
+
+# Disallow sync `std::process::Command` — the async pipeline must not block the
+# tokio runtime. Use `tokio::process::Command` or wrap in
+# `tokio::task::spawn_blocking` at async call-sites. Synchronous contexts
+# (integration tests, CLI bootstrap before the runtime starts) may allow this
+# lint locally with `#[allow(clippy::disallowed_methods)]` and a comment.
+disallowed-methods = [
+    { path = "std::process::Command::new", reason = "prefer tokio::process::Command or spawn_blocking in async contexts" },
+]
+
+# Disallow the `dbg!` macro — leftover debug scaffolding should never ship.
+# Use `tracing::{debug,trace}` for durable diagnostics.
+disallowed-macros = [
+    { path = "std::dbg", reason = "leftover debug scaffolding; remove before committing" },
+]
diff --git a/src/app.rs b/src/app.rs
index cae18dc..fb099e0 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -990,6 +990,11 @@ impl App {
         // Verify we're in a git repo first
         let _git = GitService::discover()?;
 
+        // `hook_dir` is called from a synchronous `handle_hook` path (CLI
+        // bootstrap, no tokio runtime live yet). F-002 will migrate the hook /
+        // clipboard paths off sync `Command`; until then, allow the lint here
+        // so the new clippy.toml rule doesn't block unrelated PRs.
+        #[allow(clippy::disallowed_methods)]
         let output = std::process::Command::new("git")
             .args(["rev-parse", "--git-dir"])
             .output()?;
diff --git a/tests/history.rs b/tests/history.rs
index 53c7582..f24a002 100644
--- a/tests/history.rs
+++ b/tests/history.rs
@@ -2,6 +2,11 @@
 //
 // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
 
+// Integration tests are synchronous and legitimately use `std::process::Command`
+// to build git fixtures in tempdirs; the `disallowed_methods` rule in
+// clippy.toml targets async-context misuse, which does not apply here.
+#![allow(clippy::disallowed_methods)]
+
 use commitbee::services::history::{HistoryContext, HistoryService};
 
 // ─── Subject Analysis (Pure Functions) ───────────────────────────────────────
diff --git a/tests/porcelain.rs b/tests/porcelain.rs
index 0588174..121b997 100644
--- a/tests/porcelain.rs
+++ b/tests/porcelain.rs
@@ -23,6 +23,11 @@
 //! deferred to a follow-up — it requires the full pipeline setup and belongs
 //! in its own test file.
 
+// Integration tests are synchronous and legitimately use `std::process::Command`
+// to shell out to `git` / the `commitbee` binary; the `disallowed_methods` rule
+// in clippy.toml targets async-context misuse, which does not apply here.
+#![allow(clippy::disallowed_methods)]
+
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};