diff --git a/.github/workflows/validate-task.yml b/.github/workflows/validate-task.yml
index 7b00aeb0..7acc3260 100644
--- a/.github/workflows/validate-task.yml
+++ b/.github/workflows/validate-task.yml
@@ -3,10 +3,17 @@ name: Validate task
 # The fleet validation gate, hosted here once and reached by every repo's test-pull-request stub and its own publish-release stub.
 # Three jobs: lint (the fleet doc-lint block plus language lint by tree detection, the prose gate, and the repo gate), unit-test (a generic dotnet test or uv run pytest, skipped where the caller has no test project), and validate (the validate hook, a repo's own domain checks such as an ESPHome compile, a Hugo build, a KiCad ERC, a codegen-drift check, or PowerShell tests).
 # No permissions beyond contents: read where a job needs one, since every job here only checks out and reads.
-# No required inputs, and CODECOV_TOKEN is the one optional secret, since coverage upload is best-effort.
+# No required inputs, markdown-exclude-globs is the one optional input, and CODECOV_TOKEN is the one optional secret, since coverage upload is best-effort.
 # Hub-owned gates and default hooks resolve through $/ at the reusable workflow's commit, so each implementation is reproducible against the caller's released pin without a second checkout.
 on:
   workflow_call:
+    inputs:
+      # Appended after '**/*.md', not validated: a negated glob excludes, a non-negated one adds to what is linted.
+      markdown-exclude-globs:
+        description: Negated globs to exclude, one per line (for example '!content/**'), appended after '**/*.md'. A non-negated line adds to what is linted rather than narrowing it.
+        required: false
+        type: string
+        default: ''
     secrets:
       CODECOV_TOKEN:
         required: false
@@ -29,10 +36,13 @@ jobs:
           fetch-depth: 0
 
       # The fleet doc-lint block, hosted once rather than carried by every repo of every type.
+      # An empty markdown-exclude-globs leaves a blank line here, which the action ignores, so the default caller passes nothing extra.
       - name: Lint Markdown step
         uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
         with:
-          globs: '**/*.md'
+          globs: |
+            **/*.md
+            ${{ inputs.markdown-exclude-globs }}
 
       # The spell check covers README + HISTORY only, per CODESTYLE.md "Markdown and Spelling".
       - name: Spell check step
diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 1154588d..bd269976 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -349,6 +349,22 @@ jobs:
           done
 ```
 
+A repo that vendors a theme or imports content it does not author narrows the Lint Markdown step's glob instead. Blog carries a WordPress archive and the PaperMod theme, for instance. `.markdownlint-cli2.jsonc` is declared `"fidelity": "verbatim", "whole": true` in `spec/files.json`, so it is not locally editable:
+
+```yaml
+  validate:
+    name: Validate sources job
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@<hub-main-commit-sha> # <release-tag>
+    permissions:
+      contents: read
+    with:
+      markdown-exclude-globs: |
+        !content/**
+        !themes/*/**
+```
+
+`validate-task.yml` appends each line after `**/*.md` in the Lint Markdown step's own `globs:` block, unvalidated. A negated glob excludes, the intended use, but a non-negated one adds to what is linted rather than narrowing it.
+
 ## Adopting the Pure Functions
 
 Neither `get-version-task.yml` nor `publish-plan-task.yml` has a caller-stub snippet of its own, since a caller reaching either one is a job inside a repo's own `publish-release.yml` or a future `build-release-task.yml`, not a standalone top-level workflow. A repo whose publisher reads NBGV's version outputs directly, without carrying the whole release orchestrator, reaches `get-version-task.yml` by pin in place of its own copy: