diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
new file mode 100644
index 0000000..7c4409f
--- /dev/null
+++ b/.github/workflows/autofix.yml
@@ -0,0 +1,36 @@
+# Ruff rewrites quote styles and capitalises docstrings without any help
+# from a person, so a contributor should never have to. This hands those
+# fixes to the autofix.ci app, which commits them to the pull request
+# branch, forks included. The existing lint gate still reports any
+# findings that ruff cannot fix.
+#
+# The filename and the workflow name are both fixed by autofix.ci, which
+# uses them to identify the workflow it trusts. Renaming either one stops
+# the app from accepting the patch.
+name: autofix.ci # needed to securely identify the workflow
+
+on:
+  pull_request:
+  push:
+    branches: [develop, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  autofix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: '3.13'
+      - run: uvx --with tox-uv tox -e ruff-fix
+      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 354ce26..009648a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,7 +134,13 @@ jobs:
           mkdir -p "$RUNNER_TEMP/tectonic-bin"
           tar -xzf "$RUNNER_TEMP/tectonic.tar.gz" -C "$RUNNER_TEMP/tectonic-bin" tectonic
           echo "$RUNNER_TEMP/tectonic-bin" >> "$GITHUB_PATH"
+      - name: Apply Ruff fixes to pull requests
+        if: github.event_name == 'pull_request' && matrix.env == 'lint'
+        run: tox -e ruff-fix
       - name: Run ${{ matrix.env }}
+        env:
+          RUFF_OUTPUT_FORMAT: >-
+            ${{ github.event_name == 'pull_request' && 'github' || 'full' }}
         run: tox -e "$TOX_ENV"
       - name: Upload documentation preview
         if: matrix.env == 'docs' || matrix.env == 'docs-formats'
diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
index 476d4c9..53046f9 100644
--- a/CONTRIBUTING.rst
+++ b/CONTRIBUTING.rst
@@ -116,3 +116,15 @@ Before submission, confirm the full CI result and inspect all required matrix
 jobs. Report any check you could not run, including missing interpreters or
 external tools. Release work has additional verification described in the
 release guide. A contributor patch does not publish a release.
+
+Automatic formatting
+--------------------
+
+Pull requests apply Ruff fixes before the lint check. With the autofix.ci
+app installed for this repository, those fixes are committed to the pull
+request branch, including forks. Findings Ruff cannot fix still fail CI.
+Push builds check the committed files without applying fixes.
+
+Apply the same fixes locally with::
+
+    uvx --with tox-uv tox -e ruff-fix
diff --git a/tox.ini b/tox.ini
index b3ba2f5..dc9020c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -46,6 +46,7 @@ commands =
 # ── Lint and formatting ──────────────────────────────────────
 
 [testenv:lint]
+pass_env = RUFF_OUTPUT_FORMAT
 description = Lint and format-check the Python sources with ruff
 skip_install = true
 deps = ruff>=0.16
@@ -175,3 +176,13 @@ description = Scan the installed dependencies for known vulnerabilities
 extras = tests, docs
 deps = pip-audit>=2.7
 commands = pip-audit
+
+
+[testenv:ruff-fix]
+labels = fix
+description = Apply the available Ruff fixes
+skip_install = true
+deps = ruff>=0.16
+commands =
+    ruff check --fix --exit-zero
+    ruff format