diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6984419d..8ebac705 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -22,3 +22,17 @@ updates:
     directory: /
     schedule:
       interval: weekly
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      hooks:
+        patterns:
+        - "*"
+        update-types:
+        - "patch"
+        - "minor"
diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml
new file mode 100644
index 00000000..cf9a50ef
--- /dev/null
+++ b/.github/jactionlint.yaml
@@ -0,0 +1,2 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/jdx/jactionlint/main/schema/jactionlint-config.json
+profile: correctness
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b56a351..23ae0315 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,19 @@ on: [push]
 permissions: {}
 
 jobs:
+  lint:
+    permissions:
+      contents: read
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        with:
+          prek-version: 0.5.5
+
   sanity-checks:
     permissions:
       contents: read
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000..b7184044
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/jdx/jactionlint
+    rev: 1027f0a131ab98bc7e191d995bfa15dbed5bbf8f  # frozen: v2.2.0
+    hooks:
+      - id: jactionlint